Re: [PATCH] Bluetooth: RFCOMM: serialize session teardown

[Chengfeng Ye]

Hi all,

Thanks for your review and feedback, the v2 is just sent:
https://lore.kernel.org/linux-bluetooth/20260822150619.3684599-1-nicoyip.dev@xxxxxxxxx/T/#u

On Sat, Aug 22, 2026 at 4:31 PM Ali Ahmet Memis <ali@xxxxxxxxxxxxxx> wrote:
> rfcomm_security_cfm() -> rfcomm_session_get() is the one I'd worry about.
> It runs from the hci_cb callback with only hci_cb_list_lock held, while
> krfcommd can free the same session under rfcomm_mutex. I haven't tried to
> reproduce that one.

You are right on that, actually I have a reproducer for that UAF and
just have not yet been able to send a patch for it as I am afraid
sending too many patches in a short period will introduce a high
review workload. That one is a real security issue as it can be
reachable from unprivileged users, as it is now raised in the public
maillist, I will send a patch for it soon.

Best regards,
Chengfeng