CVE-2026-98290

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup

rfcomm_sock_cleanup_listen() closes unaccepted child sockets through

rfcomm_sock_close(), which takes the child socket lock before

rfcomm_dlc_close() acquires rfcomm_mutex. The RFCOMM worker takes these

locks in reverse order while handling connections and DLC state changes,

so lockdep reports a possible deadlock.

Close dequeued children without taking their socket lock. The accept queue

owns a reference to each child, and bt_accept_dequeue() locks the child

while unlinking it and clearing its parent pointer.

Dropping the child lock makes it important to prevent a concurrent

rfcomm_connect_ind() from enqueueing a new child after cleanup observes an

empty queue. Set a listening socket to BT_CLOSED while its lock is still

held, before dropping the lock and draining the queue. The state check in

rfcomm_connect_ind() then rejects new children once cleanup starts.