CVE-2026-97408
Received Received - Intake

Bluetooth L2CAP Connectionless PSM Length Validation Flaw

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: validate connectionless PSM length Connectionless L2CAP frames carry a two-byte PSM at the start of the payload. l2cap_recv_frame() currently reads that PSM unconditionally after validating only the outer L2CAP length. A malformed connectionless frame with a zero- or one-byte payload can therefore make the parser read beyond the advertised skb payload and use tailroom bytes as part of the PSM. A VHCI-backed QEMU reproducer injected a one-byte connectionless payload and reached the unchecked read. Reject connectionless frames that cannot contain the PSM before reading or pulling it. This preserves all valid connectionless frames while dropping only structurally incomplete packets.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-24
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-97408
EUVD
EUVD-2026-86221

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves improper validation of connectionless L2CAP frames in Bluetooth. The parser reads a two-byte PSM field without checking if the frame has enough payload bytes, potentially reading beyond the actual data and accessing invalid memory.

Detection Guidance

This vulnerability involves malformed Bluetooth L2CAP connectionless frames. Detection requires monitoring for abnormal Bluetooth traffic patterns or crashes in Bluetooth subsystems. Check kernel logs for Bluetooth-related errors or warnings using commands like dmesg | grep -i bluetooth or journalctl -u bluetooth. Inspect network traffic with tools like Wireshark for malformed L2CAP frames.

Impact Analysis

An attacker could exploit this to cause a denial of service or potentially execute arbitrary code on systems using vulnerable Linux kernel versions. Systems with Bluetooth enabled, especially those using VHCI-backed QEMU, are at higher risk.

Mitigation Strategies

Apply the latest Linux kernel security patches to address the issue. Disable Bluetooth if not in use. Restrict Bluetooth access to trusted devices only. Monitor system logs for unusual Bluetooth activity. Update QEMU if running virtualized environments with Bluetooth passthrough.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97408. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart