CVE-2026-10654

{
  "id": "CVE-2026-10654",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-30T17:16:20.273",
  "lastModified": "2026-10-25T21:10:00.770",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A race condition in the Zephyr Bluetooth Classic RFCOMM host stack (subsys/bluetooth/host/classic/rfcomm.c) mishandles a simultaneous bidirectional session disconnect. When the local device has initiated a session teardown (state BT_RFCOMM_STATE_DISCONNECTING, DISC sent, RTX timer armed) and the connected peer concurrently sends its own DISC frame for dlci 0, rfcomm_handle_disc() invokes rfcomm_session_disconnected(), which unconditionally forced the session to BT_RFCOMM_STATE_DISCONNECTED without ever calling bt_l2cap_chan_disconnect().\n\nBecause the recovery timer was also cancelled and a later UA is ignored in the DISCONNECTED state, the session becomes permanently wedged: the underlying L2CAP channel is never released and the session slot in the fixed bt_rfcomm_pool[CONFIG_BT_MAX_CONN] array is never reclaimed (its conn pointer stays set).\n\nSubsequent bt_rfcomm_dlc_connect() calls on that connection fail with -EINVAL due to the invalid session state, so RFCOMM service is denied for that peer, and repeated occurrences can exhaust the session pool. The DISC frame is peer-controlled over the air, but exploitation requires the peer's DISC to collide with a local-initiated disconnect (a high-complexity timing race). Impact is availability/resource-leak only; there is no memory-safety, confidentiality, or integrity consequence. The defect shipped in released versions (present in v4.4.0 and earlier).\n\nThe fix only transitions to DISCONNECTED when the session is not already in DISCONNECTING, preserving the proper L2CAP teardown path."
    },
    {
      "lang": "es",
      "value": "Una condición de carrera en la pila de host RFCOMM Bluetooth Classic de Zephyr (subsys/bluetooth/host/classic/rfcomm.c) maneja incorrectamente una desconexión de sesión bidireccional simultánea. Cuando el dispositivo local ha iniciado una terminación de sesión (estado BT_RFCOMM_STATE_DISCONNECTING, DISC enviado, temporizador RTX activado) y el par conectado envía concurrentemente su propio frame DISC para dlci 0, rfcomm_handle_disc() invoca a rfcomm_session_disconnected(), lo que forzó incondicionalmente la sesión a BT_RFCOMM_STATE_DISCONNECTED sin llamar nunca a bt_l2cap_chan_disconnect().\n\nDebido a que el temporizador de recuperación también fue cancelado y un UA posterior es ignorado en el estado DISCONNECTED, la sesión queda permanentemente atascada: el canal L2CAP subyacente nunca se libera y el slot de sesión en el array fijo bt_rfcomm_pool[CONFIG_BT_MAX_CONN] nunca se recupera (su puntero conn permanece establecido).\n\nLas llamadas posteriores a bt_rfcomm_dlc_connect() en esa conexión fallan con -EINVAL debido al estado de sesión inválido, por lo que el servicio RFCOMM es denegado para ese par, y las ocurrencias repetidas pueden agotar el pool de sesiones. El frame DISC es controlado por el par por aire, pero la explotación requiere que el DISC del par colisione con una desconexión iniciada localmente (una condición de carrera de temporización de alta complejidad). El impacto es solo de disponibilidad/fuga de recursos; no hay consecuencias de seguridad de memoria, confidencialidad o integridad. El defecto se envió en versiones lanzadas (presente en v4.4.0 y anteriores).\n\nLa solución solo transiciona a DISCONNECTED cuando la sesión no está ya en DISCONNECTING, preservando la ruta de terminación L2CAP adecuada."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "zephyrproject",
          "product": "zephyr",
          "defaultStatus": "unaffected",
          "collectionURL": "https://github.com/zephyrproject-rtos/zephyr",
          "packageName": "zephyr",
          "programFiles": [
            "subsys/bluetooth/host/classic/rfcomm.c"
          ],
          "versions": [
            {
              "version": "1.6.0",
              "lessThan": "4.3.1",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "4.4.0",
              "lessThan": "4.4.2",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
          "baseScore": 3.1,
          "baseSeverity": "LOW",
          "attackVector": "ADJACENT_NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-30T16:43:44.096386Z",
          "id": "CVE-2026-10654",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-362"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:zephyrproject:zephyr:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "1.6.0",
              "versionEndIncluding": "4.4.1",
              "matchCriteriaId": "B3D3C245-AA71-4EA2-99BA-1BC846356659"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/zephyrproject-rtos/zephyr/commit/c67b59f891a3a8697f1edb2a0e559fc267e75cc2",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-4m37-wp5x-hq4h",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Patch",
        "Vendor Advisory"
      ]
    }
  ]
}