Use-after-free in Linux kernel - CVE-2026-53256

Vulnerability identifier: #VU135496

CSH Severity: Medium

CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-53256

CWE-ID: CWE-416

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a use-after-free in rfcomm_connect_ind() and rfcomm_get_sock_by_channel() when handling RFCOMM connection indications for a listener socket during a concurrent close. A remote attacker can trigger a race condition to cause a denial of service.

The issue occurs in the Linux kernel Bluetooth RFCOMM socket handling path when a listener socket is closed while a child socket is being queued, and KASAN reported the resulting slab-use-after-free in lock_sock_nested().

Linux kernel
SUSE Linux Enterprise Server 15 SP6
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Availability Extension 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Workstation Extension 15
SUSE Linux Enterprise Live Patching
Basesystem Module
Public Cloud Module
Legacy Module
Development Tools Module
SUSE Real Time Module
openSUSE Leap
openEuler
kernel-livepatch-6_4_0-150600_23_125-default-debuginfo
kernel-livepatch-6_4_0-150600_23_125-default
kernel-livepatch-SLE15-SP6_Update_29-debugsource
kernel-livepatch-6_4_0-150700_7_67-rt
kernel-livepatch-SLE15-SP7-RT_Update_18-debugsource
kernel-livepatch-6_4_0-150700_7_67-rt-debuginfo
kernel-livepatch-SLE15-SP7_Update_19-debugsource
kernel-livepatch-6_4_0-150700_53_73-default
kernel-livepatch-6_4_0-150700_53_73-default-debuginfo
python3-perf-debuginfo
kernel
bpftool
bpftool-debuginfo
kernel-debugsource
kernel-devel
kernel-headers
kernel-source
kernel-tools
kernel-tools-debuginfo
kernel-tools-devel
perf
kernel-debuginfo
perf-debuginfo
python3-perf
gfs2-kmp-default-debuginfo
kernel-obs-qa
kernel-default-extra
gfs2-kmp-default
kernel-kvmsmall-devel-debuginfo
kernel-kvmsmall-devel
kernel-source-vanilla
kernel-kvmsmall-debuginfo
kernel-kvmsmall-debugsource
kernel-obs-build-debugsource
kernel-default-devel-debuginfo
reiserfs-kmp-default-debuginfo
ocfs2-kmp-default
cluster-md-kmp-default
dlm-kmp-default-debuginfo
kernel-default-optional
kernel-syms
kselftests-kmp-default-debuginfo
ocfs2-kmp-default-debuginfo
cluster-md-kmp-default-debuginfo
kernel-obs-build
kernel-default-debugsource
dtb-aarch64
kernel-default-vdso-debuginfo
kernel-debug-vdso
kernel-default-vdso
kernel-kvmsmall-vdso-debuginfo
kernel-kvmsmall-vdso
kernel-debug-vdso-debuginfo
kernel-zfcpdump-debugsource
kernel-zfcpdump-debuginfo
kernel-debug
kernel-64kb
kernel-docs
kernel-macros
kernel-debug-debuginfo
kernel-debug-devel
kernel-debug-devel-debuginfo
kernel-debug-debugsource
kernel-default
kernel-kvmsmall
kernel-default-livepatch-devel
kernel-zfcpdump
kernel-docs-html
dtb-nvidia
reiserfs-kmp-default
kselftests-kmp-64kb
dtb-altera
dtb-broadcom
kernel-64kb-devel-debuginfo
dtb-arm
dtb-renesas
ocfs2-kmp-64kb-debuginfo
reiserfs-kmp-64kb-debuginfo
ocfs2-kmp-64kb
kernel-64kb-extra
dtb-mediatek
dtb-xilinx
kernel-64kb-debugsource
kernel-64kb-extra-debuginfo
dtb-sprd
kernel-64kb-debuginfo
dtb-amd
dtb-amlogic
cluster-md-kmp-64kb-debuginfo
dtb-amazon
dlm-kmp-64kb
kselftests-kmp-64kb-debuginfo
dtb-apm
dtb-lg
kernel-64kb-optional-debuginfo
kernel-default-livepatch
dlm-kmp-default
kernel-default-debuginfo
kernel-default-devel
kselftests-kmp-default
kernel-default-optional-debuginfo
kernel-default-extra-debuginfo
kernel-64kb-optional
dtb-socionext
gfs2-kmp-64kb
dlm-kmp-64kb-debuginfo
dtb-rockchip
dtb-freescale
reiserfs-kmp-64kb
kernel-64kb-devel
dtb-qcom
cluster-md-kmp-64kb
dtb-hisilicon
gfs2-kmp-64kb-debuginfo
dtb-cavium
dtb-exynos
dtb-marvell
dtb-apple
dtb-allwinner
kernel-default-base
kernel-default-base-rebuild
ocfs2-kmp-rt-debuginfo
kernel-rt
kernel-source-rt
kernel-devel-rt
kernel-rt-debuginfo
dlm-kmp-rt
cluster-md-kmp-rt
kernel-rt-debugsource
kernel-syms-rt
cluster-md-kmp-rt-debuginfo
gfs2-kmp-rt-debuginfo
kernel-rt-devel
dlm-kmp-rt-debuginfo
gfs2-kmp-rt
ocfs2-kmp-rt
kernel-rt-devel-debuginfo
kernel-azure-debugsource
kernel-azure-devel
kernel-azure-devel-debuginfo
kernel-azure
kernel-azure-debuginfo

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
kernel-livepatch-6_4_0-150600_23_125-default-debuginfo - update to 1-150600.13.7.1
kernel-livepatch-6_4_0-150600_23_125-default - update to 1-150600.13.7.1
kernel-livepatch-SLE15-SP6_Update_29-debugsource - update to 1-150600.13.7.1
kernel-livepatch-6_4_0-150700_7_67-rt - update to 1-150700.1.5.1
kernel-livepatch-SLE15-SP7-RT_Update_18-debugsource - update to 1-150700.1.5.1
kernel-livepatch-6_4_0-150700_7_67-rt-debuginfo - update to 1-150700.1.5.1
kernel-livepatch-SLE15-SP7_Update_19-debugsource - update to 1-150700.15.3.4
kernel-livepatch-6_4_0-150700_53_73-default - update to 1-150700.15.3.4
kernel-livepatch-6_4_0-150700_53_73-default-debuginfo - update to 1-150700.15.3.4
python3-perf-debuginfo - addressed in versions 5.10.0-328.0.0.229, 6.6.0-145.1.20.157
kernel - addressed in versions 5.10.0-328.0.0.229, 6.6.0-145.1.20.157
bpftool - addressed in versions 5.10.0-328.0.0.229, 6.6.0-145.1.20.157
bpftool-debuginfo - addressed in versions 5.10.0-328.0.0.229, 6.6.0-145.1.20.157
kernel-debugsource - addressed in versions 5.10.0-328.0.0.229, 6.6.0-145.1.20.157
kernel-devel - addressed in versions 5.10.0-328.0.0.229, 6.6.0-145.1.20.157
kernel-headers - addressed in versions 5.10.0-328.0.0.229, 6.6.0-145.1.20.157
kernel-source - addressed in versions 5.10.0-328.0.0.229, 6.6.0-145.1.20.157
kernel-tools - addressed in versions 5.10.0-328.0.0.229, 6.6.0-145.1.20.157
kernel-tools-debuginfo - addressed in versions 5.10.0-328.0.0.229, 6.6.0-145.1.20.157
kernel-tools-devel - addressed in versions 5.10.0-328.0.0.229, 6.6.0-145.1.20.157
perf - addressed in versions 5.10.0-328.0.0.229, 6.6.0-145.1.20.157
kernel-debuginfo - addressed in versions 5.10.0-328.0.0.229, 6.6.0-145.1.20.157
perf-debuginfo - addressed in versions 5.10.0-328.0.0.229, 6.6.0-145.1.20.157
python3-perf - addressed in versions 5.10.0-328.0.0.229, 6.6.0-145.1.20.157
gfs2-kmp-default-debuginfo - addressed in versions 6.4.0-150600.23.125.1, 6.4.0-150700.53.73.2
kernel-obs-qa - update to 6.4.0-150600.23.125.1
kernel-default-extra - addressed in versions 6.4.0-150600.23.125.1, 6.4.0-150700.53.73.2
gfs2-kmp-default - addressed in versions 6.4.0-150600.23.125.1, 6.4.0-150700.53.73.2
kernel-kvmsmall-devel-debuginfo - update to 6.4.0-150600.23.125.1
kernel-kvmsmall-devel - update to 6.4.0-150600.23.125.1
kernel-source-vanilla - update to 6.4.0-150600.23.125.1
kernel-kvmsmall-debuginfo - update to 6.4.0-150600.23.125.1
kernel-kvmsmall-debugsource - update to 6.4.0-150600.23.125.1
kernel-obs-build-debugsource - addressed in versions 6.4.0-150600.23.125.1, 6.4.0-150700.53.73.2
kernel-default-devel-debuginfo - addressed in versions 6.4.0-150600.23.125.1, 6.4.0-150700.53.73.2
reiserfs-kmp-default-debuginfo - addressed in versions 6.4.0-150600.23.125.1, 6.4.0-150700.53.73.2
ocfs2-kmp-default - addressed in versions 6.4.0-150600.23.125.1, 6.4.0-150700.53.73.2
cluster-md-kmp-default - addressed in versions 6.4.0-150600.23.125.1, 6.4.0-150700.53.73.2
dlm-kmp-default-debuginfo - addressed in versions 6.4.0-150600.23.125.1, 6.4.0-150700.53.73.2
kernel-default-optional - update to 6.4.0-150600.23.125.1
kernel-syms - addressed in versions 6.4.0-150600.23.125.1, 6.4.0-150700.53.73.1
kselftests-kmp-default-debuginfo - update to 6.4.0-150600.23.125.1
ocfs2-kmp-default-debuginfo - addressed in versions 6.4.0-150600.23.125.1, 6.4.0-150700.53.73.2
cluster-md-kmp-default-debuginfo - addressed in versions 6.4.0-150600.23.125.1, 6.4.0-150700.53.73.2
kernel-obs-build - addressed in versions 6.4.0-150600.23.125.1, 6.4.0-150700.53.73.2
kernel-default-debugsource - addressed in versions 6.4.0-150600.23.125.1, 6.4.0-150700.53.73.2
kernel-source - addressed in versions 6.4.0-150600.23.125.1, 6.4.0-150700.53.73.1
dtb-aarch64 - update to 6.4.0-150600.23.125.1
kernel-default-vdso-debuginfo - update to 6.4.0-150600.23.125.1
kernel-debug-vdso - update to 6.4.0-150600.23.125.1
kernel-default-vdso - update to 6.4.0-150600.23.125.1
kernel-kvmsmall-vdso-debuginfo - update to 6.4.0-150600.23.125.1
kernel-kvmsmall-vdso - update to 6.4.0-150600.23.125.1
kernel-debug-vdso-debuginfo - update to 6.4.0-150600.23.125.1
kernel-zfcpdump-debugsource - addressed in versions 6.4.0-150600.23.125.1, 6.4.0-150700.53.73.2
kernel-zfcpdump-debuginfo - addressed in versions 6.4.0-150600.23.125.1, 6.4.0-150700.53.73.2
kernel-debug - update to 6.4.0-150600.23.125.1
kernel-64kb - addressed in versions 6.4.0-150600.23.125.1, 6.4.0-150700.53.73.2
kernel-docs - addressed in versions 6.4.0-150600.23.125.1, 6.4.0-150700.53.73.1
kernel-macros - addressed in versions 6.4.0-150600.23.125.1, 6.4.0-150700.53.73.1
kernel-debug-debuginfo - update to 6.4.0-150600.23.125.1
kernel-debug-devel - update to 6.4.0-150600.23.125.1
kernel-debug-devel-debuginfo - update to 6.4.0-150600.23.125.1
kernel-debug-debugsource - update to 6.4.0-150600.23.125.1
kernel-default - addressed in versions 6.4.0-150600.23.125.1, 6.4.0-150700.53.73.2
kernel-kvmsmall - update to 6.4.0-150600.23.125.1
kernel-default-livepatch-devel - addressed in versions 6.4.0-150600.23.125.1, 6.4.0-150700.53.73.2
kernel-zfcpdump - addressed in versions 6.4.0-150600.23.125.1, 6.4.0-150700.53.73.2
kernel-docs-html - update to 6.4.0-150600.23.125.1
kernel-devel - addressed in versions 6.4.0-150600.23.125.1, 6.4.0-150700.53.73.1
dtb-nvidia - update to 6.4.0-150600.23.125.1
reiserfs-kmp-default - addressed in versions 6.4.0-150600.23.125.1, 6.4.0-150700.53.73.2
kselftests-kmp-64kb - update to 6.4.0-150600.23.125.1
dtb-altera - update to 6.4.0-150600.23.125.1
dtb-broadcom - update to 6.4.0-150600.23.125.1
kernel-64kb-devel-debuginfo - addressed in versions 6.4.0-150600.23.125.1, 6.4.0-150700.53.73.2
dtb-arm - update to 6.4.0-150600.23.125.1
dtb-renesas - update to 6.4.0-150600.23.125.1
ocfs2-kmp-64kb-debuginfo - update to 6.4.0-150600.23.125.1
reiserfs-kmp-64kb-debuginfo - update to 6.4.0-150600.23.125.1
ocfs2-kmp-64kb - update to 6.4.0-150600.23.125.1
kernel-64kb-extra - update to 6.4.0-150600.23.125.1
dtb-mediatek - update to 6.4.0-150600.23.125.1
dtb-xilinx - update to 6.4.0-150600.23.125.1
kernel-64kb-debugsource - addressed in versions 6.4.0-150600.23.125.1, 6.4.0-150700.53.73.2
kernel-64kb-extra-debuginfo - update to 6.4.0-150600.23.125.1
dtb-sprd - update to 6.4.0-150600.23.125.1
kernel-64kb-debuginfo - addressed in versions 6.4.0-150600.23.125.1, 6.4.0-150700.53.73.2
dtb-amd - update to 6.4.0-150600.23.125.1
dtb-amlogic - update to 6.4.0-150600.23.125.1
cluster-md-kmp-64kb-debuginfo - update to 6.4.0-150600.23.125.1
dtb-amazon - update to 6.4.0-150600.23.125.1
dlm-kmp-64kb - update to 6.4.0-150600.23.125.1
kselftests-kmp-64kb-debuginfo - update to 6.4.0-150600.23.125.1
dtb-apm - update to 6.4.0-150600.23.125.1
dtb-lg - update to 6.4.0-150600.23.125.1
kernel-64kb-optional-debuginfo - update to 6.4.0-150600.23.125.1
kernel-default-livepatch - addressed in versions 6.4.0-150600.23.125.1, 6.4.0-150700.53.73.2
dlm-kmp-default - addressed in versions 6.4.0-150600.23.125.1, 6.4.0-150700.53.73.2
kernel-default-debuginfo - addressed in versions 6.4.0-150600.23.125.1, 6.4.0-150700.53.73.2
kernel-default-devel - addressed in versions 6.4.0-150600.23.125.1, 6.4.0-150700.53.73.2
kselftests-kmp-default - update to 6.4.0-150600.23.125.1
kernel-default-optional-debuginfo - update to 6.4.0-150600.23.125.1
kernel-default-extra-debuginfo - addressed in versions 6.4.0-150600.23.125.1, 6.4.0-150700.53.73.2
kernel-64kb-optional - update to 6.4.0-150600.23.125.1
dtb-socionext - update to 6.4.0-150600.23.125.1
gfs2-kmp-64kb - update to 6.4.0-150600.23.125.1
dlm-kmp-64kb-debuginfo - update to 6.4.0-150600.23.125.1
dtb-rockchip - update to 6.4.0-150600.23.125.1
dtb-freescale - update to 6.4.0-150600.23.125.1
reiserfs-kmp-64kb - update to 6.4.0-150600.23.125.1
kernel-64kb-devel - addressed in versions 6.4.0-150600.23.125.1, 6.4.0-150700.53.73.2
dtb-qcom - update to 6.4.0-150600.23.125.1
cluster-md-kmp-64kb - update to 6.4.0-150600.23.125.1
dtb-hisilicon - update to 6.4.0-150600.23.125.1
gfs2-kmp-64kb-debuginfo - update to 6.4.0-150600.23.125.1
dtb-cavium - update to 6.4.0-150600.23.125.1
dtb-exynos - update to 6.4.0-150600.23.125.1
dtb-marvell - update to 6.4.0-150600.23.125.1
dtb-apple - update to 6.4.0-150600.23.125.1
dtb-allwinner - update to 6.4.0-150600.23.125.1
kernel-default-base - addressed in versions 6.4.0-150600.23.125.1.150600.12.58.3, 6.4.0-150700.53.73.2.150700.17.41.4
kernel-default-base-rebuild - update to 6.4.0-150600.23.125.1.150600.12.58.3
ocfs2-kmp-rt-debuginfo - update to 6.4.0-150700.7.67.1
kernel-rt - update to 6.4.0-150700.7.67.1
kernel-source-rt - update to 6.4.0-150700.7.67.1
kernel-devel-rt - update to 6.4.0-150700.7.67.1
kernel-rt-debuginfo - update to 6.4.0-150700.7.67.1
dlm-kmp-rt - update to 6.4.0-150700.7.67.1
cluster-md-kmp-rt - update to 6.4.0-150700.7.67.1
kernel-rt-debugsource - update to 6.4.0-150700.7.67.1
kernel-syms-rt - update to 6.4.0-150700.7.67.1
cluster-md-kmp-rt-debuginfo - update to 6.4.0-150700.7.67.1
gfs2-kmp-rt-debuginfo - update to 6.4.0-150700.7.67.1
kernel-rt-devel - update to 6.4.0-150700.7.67.1
dlm-kmp-rt-debuginfo - update to 6.4.0-150700.7.67.1
gfs2-kmp-rt - update to 6.4.0-150700.7.67.1
ocfs2-kmp-rt - update to 6.4.0-150700.7.67.1
kernel-rt-devel-debuginfo - update to 6.4.0-150700.7.67.1
kernel-azure-debugsource - update to 6.4.0-150700.53.73.2
kernel-azure-devel - update to 6.4.0-150700.53.73.2
kernel-azure-devel-debuginfo - update to 6.4.0-150700.53.73.2
kernel-azure - update to 6.4.0-150700.53.73.2
kernel-azure-debuginfo - update to 6.4.0-150700.53.73.2

• https://git.kernel.org/stable/c/1f73f92f66251065a5f39b09a47cf05ea14d3107
• https://git.kernel.org/stable/c/43c441edacf953b39517a44f5e5e10a93618b226
• https://git.kernel.org/stable/c/6f4462d12133106460d7c046b95aad2491e3fddf
• https://git.kernel.org/stable/c/8802413ce63175fb522a2bd609fb043a3550c720
• https://git.kernel.org/stable/c/a07d741c077d4e34b16458241a94d29039386553
• https://git.kernel.org/stable/c/b0e33e409715c617e2a20f46f99aa5403a14dfda
• https://git.kernel.org/stable/c/de31973ef00e5aa55496f84cf6a44bb157a34e02
• https://git.kernel.org/stable/c/f5ec76bdbeb80f75ad0be204371afffee0f8fac8

• Use-after-free in Linux kernel bluetooth rfcomm
• SUSE update for the Linux Kernel
• SUSE update for the Linux Kernel
• SUSE update for the Linux Kernel
• openEuler 24.03 LTS SP1 update for kernel
• openEuler 22.03 LTS SP4 update for kernel