CVE-2026-98455: Software Security Vulnerability Vulnerability

UNKNOWN
Advisory Identifier: GHSA-5qmc-rg3w-hx9m
Share
Published
Advisory Summary

CVE-2026-98455 is a security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-98455 at a Glance

CVE Identifier CVE-2026-98455
GHSA Identifier GHSA-5qmc-rg3w-hx9m
Severity N/A
CVSS v3.1 Base Score N/A
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

How to Fix CVE-2026-98455

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-98455, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO The RFCOMM_CONNINFO getsockopt handler accepts a socket that is not connected as long as deferred setup is enabled: if (sk->sk_state != BT_CONNECTED && !rfcomm_pi(sk)->dlc->defer_setup) { err = -ENOTCONN; break; } l2cap_sk = rfcomm_pi(sk)->dlc->session->sock->sk; dlc->defer_setup is set in rfcomm_sock_init() when rfcomm_connect_ind() creates a child socket for an incoming connection on a listening socket that has BT_DEFER_SETUP enabled. It is never cleared afterwards. The session, however, can go away underneath it. rfcomm_recv_disc() forces the dlc state before tearing it down: d->state = BT_CLOSED; __rfcomm_dlc_close(d, err); The RFCOMM_DEFER_SETUP early return in __rfcomm_dlc_close() only covers BT_CONNECT, BT_CONFIG, BT_OPEN and BT_CONNECT2, so with the state already BT_CLOSED that switch does not match and the function falls through to rfcomm_dlc_unlink(), which sets d->session = NULL, while d->defer_setup stays 1. A getsockopt(SOL_RFCOMM, RFCOMM_CONNINFO) on the accepted socket after that point therefore skips the -ENOTCONN path -- sk->sk_state is BT_CLOSED, but dlc->defer_setup is still set -- and dereferences the NULL session. No race is needed: once the DISC has been processed, the dereference is unconditional. Reproduced on a KASAN kernel under QEMU with a BR/EDR peer emulated over /dev/vhci: the peer brings up an ACL link, opens L2CAP on the RFCOMM PSM, starts a session and sends SABM for a channel bound with BT_DEFER_SETUP, and sends DISC for that dlci after the socket has been accepted. getsockopt(SOL_RFCOMM, RFCOMM_CONNINFO) on the accepted socket then hits: Oops: general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] CPU: 1 UID: 0 PID: 150 Comm: init Tainted: G B 7.3.0-rc3-g5dd1818b15d9 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) RIP: 0010:rfcomm_sock_getsockopt+0x529/0x780 Call Trace: <TASK> do_sock_getsockopt+0x3ad/0x7d0 __sys_getsockopt+0x10e/0x1b0 __x64_sys_getsockopt+0xc2/0x160 do_syscall_64+0xda/0x4b0 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> 0x10 is the offset of sock in struct rfcomm_session; rfcomm_sock_getsockopt_old() is inlined into rfcomm_sock_getsockopt(). Commit 43a556b2fd43 ("Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept") fixed the same "a remote DISC clears the session while deferred setup is still flagged" problem in rfcomm_dlc_accept(); this is the remaining instance of it, in the getsockopt path. Deferred setup only leaves a socket usable here once it has reached BT_CONNECT2, so restrict the exception to that state and check that a session is actually present before following it.

References

NVD — CVE-2026-98455 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-98455
git.kernel.org/stable/c/005b23d9e3... WEB
https://git.kernel.org/stable/c/005b23d9e324fe5d0acbcfa70c625f2e81189046
git.kernel.org/stable/c/1c4f7e1177... WEB
https://git.kernel.org/stable/c/1c4f7e1177da2f229be04139c27e5370a1cfba52
git.kernel.org/stable/c/46f8ffd0a1... WEB
https://git.kernel.org/stable/c/46f8ffd0a1f1eb6cbc94946a92c11ef601e228a1
git.kernel.org/stable/c/4bf5ca4720... WEB
https://git.kernel.org/stable/c/4bf5ca47203049ce3648f750a53dcdc98bcc9e3e
git.kernel.org/stable/c/84ae3cfd7d... WEB
https://git.kernel.org/stable/c/84ae3cfd7d3a63591a2eb4faa24faf678c6708aa
git.kernel.org/stable/c/8f5b30cc12... WEB
https://git.kernel.org/stable/c/8f5b30cc12c409ff62891e47ed51e6bf0945a3ea
git.kernel.org/stable/c/c3aee3fc12... WEB
https://git.kernel.org/stable/c/c3aee3fc1287c8a555baf3895959087cb0c33fe8
git.kernel.org/stable/c/c7362f6a18... WEB
https://git.kernel.org/stable/c/c7362f6a18ed167f52f08ce25eeec8a7818c5004

Frequently Asked Questions

What is CVE-2026-98455?
CVE-2026-98455 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-98455?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What CWE is associated with CVE-2026-98455?
CVE-2026-98455 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-98455?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-5qmc-rg3w-hx9m",
  "modified" : "2026-10-18T18:31:49Z",
  "published" : "2026-10-18T18:31:49Z",
  "aliases" : [ "CVE-2026-98455" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO\n\nThe RFCOMM_CONNINFO getsockopt handler accepts a socket that is not\nconnected as long as deferred setup is enabled:\n\n\tif (sk->sk_state != BT_CONNECTED &&\n\t\t\t\t!rfcomm_pi(sk)->dlc->defer_setup) {\n\t\terr = -ENOTCONN;\n\t\tbreak;\n\t}\n\tl2cap_sk = rfcomm_pi(sk)->dlc->session->sock->sk;\n\ndlc->defer_setup is set in rfcomm_sock_init() when rfcomm_connect_ind()\ncreates a child socket for an incoming connection on a listening socket\nthat has BT_DEFER_SETUP enabled. It is never cleared afterwards. The\nsession, however, can go away underneath it.\n\nrfcomm_recv_disc() forces the dlc state before tearing it down:\n\n\td->state = BT_CLOSED;\n\t__rfcomm_dlc_close(d, err);\n\nThe RFCOMM_DEFER_SETUP early return in __rfcomm_dlc_close() only covers\nBT_CONNECT, BT_CONFIG, BT_OPEN and BT_CONNECT2, so with the state\nalready BT_CLOSED that switch does not match and the function falls\nthrough to rfcomm_dlc_unlink(), which sets d->session = NULL, while\nd->defer_setup stays 1.\n\nA getsockopt(SOL_RFCOMM, RFCOMM_CONNINFO) on the accepted socket after\nthat point therefore skips the -ENOTCONN path -- sk->sk_state is\nBT_CLOSED, but dlc->defer_setup is still set -- and dereferences the\nNULL session. No race is needed: once the DISC has been processed, the\ndereference is unconditional.\n\nReproduced on a KASAN kernel under QEMU with a BR/EDR peer emulated over\n/dev/vhci: the peer brings up an ACL link, opens L2CAP on the RFCOMM\nPSM, starts a session and sends SABM for a channel bound with\nBT_DEFER_SETUP, and sends DISC for that dlci after the socket has been\naccepted. getsockopt(SOL_RFCOMM, RFCOMM_CONNINFO) on the accepted\nsocket then hits:\n\n Oops: general protection fault, probably for non-canonical address\n 0xdffffc0000000002: 0000 [#1] SMP KASAN PTI\n KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]\n CPU: 1 UID: 0 PID: 150 Comm: init Tainted: G B 7.3.0-rc3-g5dd1818b15d9\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)\n RIP: 0010:rfcomm_sock_getsockopt+0x529/0x780\n Call Trace:\n  <TASK>\n  do_sock_getsockopt+0x3ad/0x7d0\n  __sys_getsockopt+0x10e/0x1b0\n  __x64_sys_getsockopt+0xc2/0x160\n  do_syscall_64+0xda/0x4b0\n  entry_SYSCALL_64_after_hwframe+0x77/0x7f\n  </TASK>\n\n0x10 is the offset of sock in struct rfcomm_session;\nrfcomm_sock_getsockopt_old() is inlined into rfcomm_sock_getsockopt().\n\nCommit 43a556b2fd43 (\"Bluetooth: RFCOMM: take rfcomm_mutex for the\ndeferred setup accept\") fixed the same \"a remote DISC clears the session\nwhile deferred setup is still flagged\" problem in rfcomm_dlc_accept();\nthis is the remaining instance of it, in the getsockopt path.\n\nDeferred setup only leaves a socket usable here once it has reached\nBT_CONNECT2, so restrict the exception to that state and check that a\nsession is actually present before following it.",
  "severity" : [ ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-98455"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/005b23d9e324fe5d0acbcfa70c625f2e81189046"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/1c4f7e1177da2f229be04139c27e5370a1cfba52"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/46f8ffd0a1f1eb6cbc94946a92c11ef601e228a1"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/4bf5ca47203049ce3648f750a53dcdc98bcc9e3e"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/84ae3cfd7d3a63591a2eb4faa24faf678c6708aa"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/8f5b30cc12c409ff62891e47ed51e6bf0945a3ea"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/c3aee3fc1287c8a555baf3895959087cb0c33fe8"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/c7362f6a18ed167f52f08ce25eeec8a7818c5004"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : null,
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-10-18T16:16:55Z"
  }
}