Loading vulnerability…
Use-after-free in Linux kernel Bluetooth RFCOMM listener handling
CVE-2026-53256 is a race-induced use-after-free vulnerability in the Linux kernel Bluetooth RFCOMM implementation. rfcomm_get_sock_by_channel() selects a listener socket under rfcomm_sk_list.lock but returns it after releasing the lock without acquiring a reference. A concurrent listener-close path through rfcomm_sock_release(), rfcomm_sock_shutdown(), and rfcomm_sock_kill() can consequently free the listener before rfcomm_connect_ind() finishes using it. Subsequent socket locking, child-socket enqueueing, flag access, or deferred-setup notification can access freed kernel memory. KASAN detected a slab-use-after-free in lock_sock_nested() called from rfcomm_connect_ind(). The vulnerability can potentially cause denial of service and is also classified as a Bluetooth-related elevation-of-privilege issue in Android.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
The race permits access to a freed kernel socket object, potentially causing kernel crashes and system-wide denial of service. Android security information identifies privilege escalation as a potential impact. A vulnerability-specific CVSS assessment rates confidentiality, integrity, and availability impacts as high. The documented diagnostic establishes the use-after-free condition, but does not demonstrate arbitrary code execution or a working privilege-escalation exploit. No known exploits are identified for this CVE.
If you can’t patch tonight, do this now.
No vulnerability-specific temporary workaround is documented. Deploy the applicable vendor security update; package installation alone does not activate an updated kernel without rebooting.
Patch, then assume compromise.
Install a vendor-supported kernel update containing the RFCOMM listener-lifetime fix and reboot into the updated kernel. The fix acquires a listener reference before releasing rfcomm_sk_list.lock, rechecks BT_LISTEN after locking the listener and before enqueueing a child, caches the deferred-setup flag while locked, and releases the reference after the final listener access. Identified fixed packages include Echo linux 6.1.176-1 or later, RHEL 8 kernel 4.18.0-553.166.1.el8_10, and RHEL 8 kernel-rt 4.18.0-553.166.1.rt7.507.el8_10. RHEL 9 and 10 fixes are supplied through RHSA-2026:67150 and RHSA-2026:65334, respectively. For affected Android devices, install the applicable manufacturer-provided November 2026 security update, preferably security patch level 2026-11-05 where available.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
19 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.