CVE-2026-98602

Received Received - Intake

Out-of-Bounds Read in Linux Kernel Bluetooth BNEP

Publication date: 2026-10-18

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough Fix multiple out-of-bounds reads in Bluetooth BNEP frame processing: 1. In bnep_rx_frame() and bnep_ctrl_frame() (net/bluetooth/bnep/core.c), use pskb_may_pull() to verify the BNEP header, control type byte, filter count, and extension headers exist before reading them, and return 0 after handling BNEP_CONTROL instead of falling through to Ethernet frame submission when no extension headers follow. 2. In bnep_net_xmit() (net/bluetooth/bnep/netdev.c), verify skb->len >= ETH_HLEN with pskb_may_pull() before reading the 14-byte Ethernet header to prevent an out-of-bounds heap read and infoleak on short AF_PACKET TX frames.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-18

EPSS Evaluated

N/A

NVD

CVE-2026-98602

EUVD

EUVD-2026-103647

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Linux	Linux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Linux	Linux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Linux	Linux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Linux	Linux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Linux	Linux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Linux	Linux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Linux	Linux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Linux	Linux	2.6.12

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is in the Linux kernel's Bluetooth BNEP (Bluetooth Network Encapsulation Protocol) implementation. It involves out-of-bounds reads in frame processing functions like bnep_rx_frame() and bnep_ctrl_frame(). The issue occurs when the code fails to verify the presence of required headers before accessing them, leading to potential memory corruption or information leaks.

Detection Guidance

This vulnerability affects Bluetooth BNEP frame processing in the Linux kernel. Detection requires checking kernel logs for Bluetooth-related errors or crashes, particularly during BNEP frame handling. Monitor for out-of-bounds read warnings or kernel panics related to bnep_rx_frame, bnep_ctrl_frame, or bnep_net_xmit functions.

Impact Analysis

An attacker within Bluetooth range could exploit this flaw to read sensitive memory contents or cause a denial of service by crashing the system. This may lead to unauthorized data access or system instability if the vulnerable kernel is used.

Compliance Impact

This vulnerability involves out-of-bounds reads in Bluetooth BNEP frame processing, which could lead to information leaks or crashes. While not directly tied to compliance standards like GDPR or HIPAA, such vulnerabilities may impact data confidentiality and system integrity, potentially affecting compliance if exploited to access sensitive data.

Mitigation Strategies

Update your Linux kernel to the latest patched version to address the Bluetooth BNEP frame processing vulnerabilities. Disable Bluetooth functionality if not in use until the patch is applied.

Hi! I’m here to help you understand CVE-2026-98602. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70