CVE-2026-68188: Bluetooth: RFCOMM: Fix session UAF in set_termios

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: RFCOMM: Fix session UAF in settermios

rfcommttysettermios() tests dlc->session without rfcommmutex and later passes the pointer to rfcommsendrpn(). The latter dereferences both session->initiator and session->sock. Meanwhile, krfcommd can unlink the DLC and free the session while holding rfcommmutex.

The race can proceed as follows:

TTY ioctl task krfcommd -------------- -------- load dlc->session enter rfcommsendrpn() lock rfcommmutex clear dlc->session free session unlock rfcommmutex read session->initiator

KASAN reported:

BUG: KASAN: slab-use-after-free in rfcommsendrpn+0x297/0x2a0 Read of size 4 at addr ffff88810012a850 by task poc/92

Call Trace: rfcommsendrpn+0x297/0x2a0 rfcommttysettermios+0x50d/0x850 ttysettermios+0x596/0x950 settermios+0x46a/0x6e0 ttymodeioctl+0x152/0xbd0 ttyioctl+0x915/0x1240 x64sysioctl+0x134/0x1c0

Allocated by task 92: rfcommsessionadd+0x9e/0x2e0 rfcommdlcopen+0x8b1/0xe00 rfcommdevactivate+0x85/0x1a0 rfcommttyopen+0x90/0x280

Freed by task 68: kfree+0x131/0x3c0 rfcommsessiondel+0x119/0x180 rfcommrun+0x737/0x4710

Add rfcommdlcsendrpn(), which holds rfcommmutex while it verifies that the DLC is still attached and sends the RPN frame. Have the TTY path use the helper and drop its unlocked session check. This keeps the session valid through both the frame construction and socket send.