CVE-2026-98600

Received Received - Intake

Bluetooth Frame Length Validation Flaw in Linux Kernel

Publication date: 2026-10-18

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame() While rfcomm_recv_frame() verifies that skb->len is at least sizeof(*hdr) + 1 (4 bytes: 3-byte header + 1-byte FCS), an RFCOMM frame with an extended 2-byte length field (!__test_ea(hdr->len)) has a 4-byte header plus a 1-byte FCS (5 bytes minimum, sizeof(*hdr) + 2). When a 4-byte RFCOMM frame with EA == 0 arrives: 1. The initial skb->len < sizeof(*hdr) + 1 check passes (4 < 4 is false). 2. Trimming the FCS byte decrements skb->len to 3. 3. If __check_fcs() succeeds, skb_pull(skb, 4) fails (4 > 3) and returns NULL without advancing skb->data. 4. Because the return value of skb_pull() is ignored, the un-pulled 3-byte struct rfcomm_hdr remains at skb->data and is either queued as application payload via rfcomm_recv_data() or parsed as a multiplexer control command via rfcomm_recv_mcc() on DLCI 0. Fix this by extending the length check in rfcomm_recv_frame() to also require skb->len >= sizeof(*hdr) + 2 when !__test_ea(hdr->len).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-18

EPSS Evaluated

N/A

NVD

CVE-2026-98600

EUVD

EUVD-2026-103645

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	fb40eda15122f6b780228639c1ead6820340ff54
Linux	Linux	3829af5fab5a22405bf1e7d69068c2ec0fce46ca
Linux	Linux	b161eacd7fa4a2d765724b5504ac6cc388e48f80
Linux	Linux	30d1d9f3495463f7c026e4c553127f79b486fcd6
Linux	Linux	67dc3b40fae71b6b11c71e7ff69bac0758818c05
Linux	Linux	bbc310caa2b6bf5fe42896ba27da0fbc12e4ac51
Linux	Linux	b230e5bf501c5edaf2eb0991cb862ac142031d4b
Linux	Linux	b230e5bf501c5edaf2eb0991cb862ac142031d4b
Linux	Linux	6.12.111
Linux	Linux	6.18.53
Linux	Linux	7.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves improper handling of Bluetooth RFCOMM frames. When a malformed 4-byte RFCOMM frame with EA=0 is received, the kernel fails to properly validate the frame length, leading to incorrect processing. The frame is not rejected as invalid, causing it to be treated as valid payload or control command, which could result in memory corruption or unexpected behavior.

Detection Guidance

This vulnerability affects the Linux kernel's Bluetooth RFCOMM implementation. Detection requires checking kernel logs for malformed RFCOMM frames or Bluetooth stack errors. Monitor dmesg or journalctl for Bluetooth-related errors. No specific commands are provided in the context to directly detect this issue.

Impact Analysis

This vulnerability could allow an attacker within Bluetooth range to send specially crafted RFCOMM frames to a vulnerable Linux system. This may cause denial of service, memory corruption, or unauthorized code execution on the affected system. Users should update their Linux kernel to a patched version to mitigate this risk.

Compliance Impact

This vulnerability affects Bluetooth RFCOMM frame handling in the Linux kernel, potentially allowing malformed frames to bypass security checks. While it does not directly impact GDPR or HIPAA compliance, it could lead to unauthorized data access or manipulation if exploited, indirectly affecting compliance by compromising system integrity and data protection measures.

Mitigation Strategies

Apply the kernel patch that extends the length check in rfcomm_recv_frame() to require skb->len >= sizeof(*hdr) + 2 when !__test_ea(hdr->len). Update to a patched Linux kernel version. Restart affected services after applying the fix.

Hi! I’m here to help you understand CVE-2026-98600. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70