CVE-2026-10654
RFCOMM session-disconnect race leaks session/L2CAP and denies further RFCOMM service in Zephyr Bluetooth Classic
Description
A race condition in the Zephyr Bluetooth Classic RFCOMM host stack (subsys/bluetooth/host/classic/rfcomm.c) mishandles a simultaneous bidirectional session disconnect. When the local device has initiated a session teardown (state BT_RFCOMM_STATE_DISCONNECTING, DISC sent, RTX timer armed) and the connected peer concurrently sends its own DISC frame for dlci 0, rfcomm_handle_disc() invokes rfcomm_session_disconnected(), which unconditionally forced the session to BT_RFCOMM_STATE_DISCONNECTED without ever calling bt_l2cap_chan_disconnect(). Because the recovery timer was also cancelled and a later UA is ignored in the DISCONNECTED state, the session becomes permanently wedged: the underlying L2CAP channel is never released and the session slot in the fixed bt_rfcomm_pool[CONFIG_BT_MAX_CONN] array is never reclaimed (its conn pointer stays set). Subsequent bt_rfcomm_dlc_connect() calls on that connection fail with -EINVAL due to the invalid session state, so RFCOMM service is denied for that peer, and repeated occurrences can exhaust the session pool. The DISC frame is peer-controlled over the air, but exploitation requires the peer's DISC to collide with a local-initiated disconnect (a high-complexity timing race). Impact is availability/resource-leak only; there is no memory-safety, confidentiality, or integrity consequence. The defect shipped in released versions (present in v4.4.0 and earlier). The fix only transitions to DISCONNECTED when the session is not already in DISCONNECTING, preserving the proper L2CAP teardown path.
INFO
Published Date :
June 30, 2026, 5:16 p.m.
Last Modified :
Oct. 25, 2026, 9:10 p.m.
Remotely Exploit :
No
Source :
[email protected]
Affected Products
The following products are affected by CVE-2026-10654
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | LOW | e2e69745-5e70-4e92-8431-deb5529a81ad | ||||
| CVSS 3.1 | LOW | [email protected] |
Solution
- Update the Zephyr Bluetooth Classic RFCOMM host stack.
- Apply any relevant patches for the described issue.
- Ensure proper session teardown procedures are followed.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-10654.
| URL | Resource |
|---|---|
| https://github.com/zephyrproject-rtos/zephyr/commit/c67b59f891a3a8697f1edb2a0e559fc267e75cc2 | Patch |
| https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-4m37-wp5x-hq4h | Exploit Patch Vendor Advisory |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-10654 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-10654
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-10654 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-10654 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 25, 2026
Action Type Old Value New Value Added Translation Title: zephyr de zephyrproject, Description: Una condición de carrera en la pila de host RFCOMM Bluetooth Classic de Zephyr (subsys/bluetooth/host/classic/rfcomm.c) maneja incorrectamente una desconexión de sesión bidireccional simultánea. Cuando el dispositivo local ha iniciado una terminación de sesión (estado BT_RFCOMM_STATE_DISCONNECTING, DISC enviado, temporizador RTX activado) y el par conectado envía concurrentemente su propio frame DISC para dlci 0, rfcomm_handle_disc() invoca a rfcomm_session_disconnected(), lo que forzó incondicionalmente la sesión a BT_RFCOMM_STATE_DISCONNECTED sin llamar nunca a bt_l2cap_chan_disconnect(). Debido a que el temporizador de recuperación también fue cancelado y un UA posterior es ignorado en el estado DISCONNECTED, la sesión queda permanentemente atascada: el canal L2CAP subyacente nunca se libera y el slot de sesión en el array fijo bt_rfcomm_pool[CONFIG_BT_MAX_CONN] nunca se recupera (su puntero conn permanece establecido). Las llamadas posteriores a bt_rfcomm_dlc_connect() en esa conexión fallan con -EINVAL debido al estado de sesión inválido, por lo que el servicio RFCOMM es denegado para ese par, y las ocurrencias repetidas pueden agotar el pool de sesiones. El frame DISC es controlado por el par por aire, pero la explotación requiere que el DISC del par colisione con una desconexión iniciada localmente (una condición de carrera de temporización de alta complejidad). El impacto es solo de disponibilidad/fuga de recursos; no hay consecuencias de seguridad de memoria, confidencialidad o integridad. El defecto se envió en versiones lanzadas (presente en v4.4.0 y anteriores). La solución solo transiciona a DISCONNECTED cuando la sesión no está ya en DISCONNECTING, preservando la ruta de terminación L2CAP adecuada. -
CVE Modified by [email protected]
Oct. 15, 2026
Action Type Old Value New Value Added Affected Affected value modified. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/10xxx/CVE-2026-10654.json">CVE-2026-10654</a> Added Reference https://github.com/zephyrproject-rtos/zephyr/commit/c67b59f891a3a8697f1edb2a0e559fc267e75cc2 Added Reference https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-4m37-wp5x-hq4h Removed Reference https://github.com/zephyrproject-rtos/zephyr/commit/c67b59f891a3a8697f1edb2a0e559fc267e75cc2 Removed Reference https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-4m37-wp5x-hq4h Removed Reference Type https://github.com/zephyrproject-rtos/zephyr/commit/c67b59f891a3a8697f1edb2a0e559fc267e75cc2 Types: Patch Removed Reference Type https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-4m37-wp5x-hq4h Types: Exploit, Patch, Vendor Advisory -
CVE Modified by [email protected]
Jul. 14, 2026
Action Type Old Value New Value Changed Affected [{'vendor': 'zephyrproject', 'product': 'zephyr', 'versions': [{'status': 'affected', 'version': '1.6.0', 'lessThan': '4.5.0', 'versionType': 'semver'}], 'packageName': 'zephyr', 'collectionURL': 'https://github.com/zephyrproject-rtos/zephyr', 'defaultStatus': 'unaffected'}] [{'vendor': 'zephyrproject', 'product': 'zephyr', 'versions': [{'status': 'affected', 'version': '1.6.0', 'lessThan': '4.5.0', 'versionType': 'semver'}], 'packageName': 'zephyr', 'programFiles': ['subsys/bluetooth/host/classic/rfcomm.c'], 'collectionURL': 'https://github.com/zephyrproject-rtos/zephyr', 'defaultStatus': 'unaffected'}] -
Initial Analysis by [email protected]
Jul. 06, 2026
Action Type Old Value New Value Added CPE Configuration OR *cpe:2.3:o:zephyrproject:zephyr:*:*:*:*:*:*:*:* versions from (including) 1.6.0 up to (including) 4.4.1 Added Reference Type Zephyr Project: https://github.com/zephyrproject-rtos/zephyr/commit/c67b59f891a3a8697f1edb2a0e559fc267e75cc2 Types: Patch Added Reference Type Zephyr Project: https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-4m37-wp5x-hq4h Types: Exploit, Patch, Vendor Advisory -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jun. 30, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-10654', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'no'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-06-30T16:43:44.096386Z'} -
New CVE Received by [email protected]
Jun. 30, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'zephyrproject', 'product': 'zephyr', 'versions': [{'status': 'affected', 'version': '1.6.0', 'lessThan': '4.5.0', 'versionType': 'semver'}], 'packageName': 'zephyr', 'collectionURL': 'https://github.com/zephyrproject-rtos/zephyr', 'defaultStatus': 'unaffected'}] Added Description A race condition in the Zephyr Bluetooth Classic RFCOMM host stack (subsys/bluetooth/host/classic/rfcomm.c) mishandles a simultaneous bidirectional session disconnect. When the local device has initiated a session teardown (state BT_RFCOMM_STATE_DISCONNECTING, DISC sent, RTX timer armed) and the connected peer concurrently sends its own DISC frame for dlci 0, rfcomm_handle_disc() invokes rfcomm_session_disconnected(), which unconditionally forced the session to BT_RFCOMM_STATE_DISCONNECTED without ever calling bt_l2cap_chan_disconnect(). Because the recovery timer was also cancelled and a later UA is ignored in the DISCONNECTED state, the session becomes permanently wedged: the underlying L2CAP channel is never released and the session slot in the fixed bt_rfcomm_pool[CONFIG_BT_MAX_CONN] array is never reclaimed (its conn pointer stays set). Subsequent bt_rfcomm_dlc_connect() calls on that connection fail with -EINVAL due to the invalid session state, so RFCOMM service is denied for that peer, and repeated occurrences can exhaust the session pool. The DISC frame is peer-controlled over the air, but exploitation requires the peer's DISC to collide with a local-initiated disconnect (a high-complexity timing race). Impact is availability/resource-leak only; there is no memory-safety, confidentiality, or integrity consequence. The defect shipped in released versions (present in v4.4.0 and earlier). The fix only transitions to DISCONNECTED when the session is not already in DISCONNECTING, preserving the proper L2CAP teardown path. Added CVSS V3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L Added CWE CWE-362 Added Reference https://github.com/zephyrproject-rtos/zephyr/commit/c67b59f891a3a8697f1edb2a0e559fc267e75cc2 Added Reference https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-4m37-wp5x-hq4h