CVE-2026-93783
Received Received - Intake

BaseFortify

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame rfcomm_recv_frame() casts skb->data to struct rfcomm_hdr and dereferences hdr->addr and hdr->ctrl without validating skb->len first. A truncated frame with skb->len less than the minimum header size causes an out-of-bounds read of uninitialized memory. Additionally, a zero-length frame causes skb->len-- to underflow to UINT_MAX, making skb_tail_pointer() read far past the buffer. Commit 23882b828c3c ("Bluetooth: RFCOMM: validate skb length in MCC handlers") fixed the same class of missing-length-check bugs in the MCC sub-handlers, but the top-level rfcomm_recv_frame() was left unfixed. KMSAN reports: BUG: KMSAN: uninit-value in rfcomm_run ... Uninit was created at: __alloc_skb+0x474/0xb60 vhci_write+0xe9/0x870 Fix this by rejecting frames smaller than sizeof(struct rfcomm_hdr) + 1 (the minimum frame must have a 3-byte header and a 1-byte FCS).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-24
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-93783
EUVD
EUVD-2026-86170

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the Linux kernel's Bluetooth RFCOMM implementation. The rfcomm_recv_frame() function fails to validate the length of incoming Bluetooth frames before processing them. It directly accesses header fields without checking if the frame is large enough, leading to out-of-bounds reads of uninitialized memory. A truncated frame or zero-length frame can cause memory corruption or crashes.

Detection Guidance

This vulnerability involves a missing length check in the Linux kernel's Bluetooth RFCOMM subsystem. Detection requires checking kernel logs for related errors or monitoring for Bluetooth-related crashes. Commands like dmesg | grep -i rfcomm or journalctl -k | grep -i rfcomm may help identify issues. Ensure your kernel is updated to a patched version.

Impact Analysis

This vulnerability could allow an attacker within Bluetooth range to cause a denial-of-service (system crash) or potentially execute arbitrary code on affected systems. It may also expose sensitive kernel memory contents. Systems using Bluetooth RFCOMM, such as those with Bluetooth keyboards or file transfers, are at risk.

Mitigation Strategies

Immediately update your Linux kernel to a version that includes the fix for CVE-2026-93783. If updating is not immediately possible, disable Bluetooth functionality temporarily or restrict Bluetooth usage to trusted networks until the patch is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-93783. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart