CVE Explorer

CVE-2026-10654

A race condition in the Zephyr Bluetooth Classic RFCOMM host stack (subsys/bluetooth/host/classic/rfcomm.c) mishandles a simultaneous bidirectional session disconnect. When the local device has initiated a session teardown (state BT_RFCOMM_STATE_DISCONNECTING, DISC sent, RTX timer armed) and the connected peer concurrently sends its own DISC frame for dlci 0, rfcomm_handle_disc() invokes rfcomm_session_disconnected(), which unconditionally forced the session to BT_RFCOMM_STATE_DISCONNECTED witho

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:ace4f1463c5a8384cf0032aa2c9d37ddb17a6dbf7dcad2819a15e2a9d2e2af55

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Affected products and versions

1 source assertion

{"collectionURL":"https://github.com/zephyrproject-rtos/zephyr","defaultStatus":"unaffected","packageName":"zephyr","product":"zephyr","programFiles":["subsys/bluetooth/host/classic/rfcomm.c"],"vendor":"zephyrproject","versions":[{"lessThan":"4.5.0","status":"affected","version":"1.6.0","versionType":"semver"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:c1dcf98ca1daf9d7eb2c0cef9ad104c1cbfbe19555307ee6a6f2424aee8c1a0e · sha256:e3d4bf2e9a6893c2… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion

{"metric":{"baseScore":3.1,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"metric_type":"cvssV3_1"}

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:c1dcf98ca1daf9d7eb2c0cef9ad104c1cbfbe19555307ee6a6f2424aee8c1a0e · sha256:e3d4bf2e9a6893c2… · /containers/cna/metrics/0/cvssV3_1

CWE assertions

1 source assertion

{"cweId":"CWE-362","description":"race","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:c1dcf98ca1daf9d7eb2c0cef9ad104c1cbfbe19555307ee6a6f2424aee8c1a0e · sha256:e3d4bf2e9a6893c2… · /containers/cna/problemTypes/0/descriptions/0

Source references

2 source assertions

{"name":"Fix commit","tags":["patch"],"url":"https://github.com/zephyrproject-rtos/zephyr/commit/c67b59f891a3a8697f1edb2a0e559fc267e75cc2"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:c1dcf98ca1daf9d7eb2c0cef9ad104c1cbfbe19555307ee6a6f2424aee8c1a0e · sha256:e3d4bf2e9a6893c2… · /containers/cna/references/0

{"name":"GHSA-4m37-wp5x-hq4h","url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-4m37-wp5x-hq4h"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:c1dcf98ca1daf9d7eb2c0cef9ad104c1cbfbe19555307ee6a6f2424aee8c1a0e · sha256:e3d4bf2e9a6893c2… · /containers/cna/references/1

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer