CVE-2026-98107
Received Received - Intake

Bluetooth Out-of-Bounds Write in Linux Kernel Bluetooth L2CAP

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix out-of-bounds write in l2cap_ecred_connect l2cap_chan_connect() tries to ensure there are no more than L2CAP_ECRED_CONN_SCID_MAX pending ECRED channels, so they fit in the same L2CAP_ECRED_CONN_REQ that l2cap_ecred_connect() constructs. However, the check only counts deferred channels. If 6 L2CAP sockets are connected at the same time in order DDDDND (D=deferred, N=non-deferred), the last can bump the total to max+1. It results to one __le16 written out of bounds of the scid array, and an invalid ECRED_CONN_REQ being sent. Fix by leaving room for the non-deferred pending ECRED channels in the counting in l2cap_chan_connect(), so the limit can't be exceeded. Move counting under same critical section where the channel is added. Although race conditions involving this appear unreachable, it's easier to see. Also add WARN_ON_ONCE check in l2cap_ecred_defer_connect() to make this less brittle.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-98107
EUVD
EUVD-2026-86938

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Bluetooth vulnerability in the Linux kernel where an out-of-bounds write can occur in the L2CAP (Logical Link Control and Adaptation Protocol) layer. The issue happens when connecting multiple L2CAP sockets simultaneously. A race condition allows the total number of pending ECRED channels to exceed the maximum limit, causing a one-byte overflow in the scid array and sending an invalid ECRED_CONN_REQ message.

Detection Guidance

This vulnerability is specific to the Linux kernel's Bluetooth L2CAP implementation and may not have direct network detection commands. Monitor kernel logs for Bluetooth-related errors or crashes, particularly involving L2CAP or ECRED channels. Check for out-of-bounds write warnings in system logs after enabling kernel debug options like CONFIG_DEBUG_KMEMLEAK or CONFIG_DEBUG_ATOMIC_SLEEP.

Impact Analysis

This vulnerability could allow an attacker to corrupt kernel memory, potentially leading to system crashes, privilege escalation, or unauthorized code execution. It specifically affects Bluetooth communication on Linux systems using vulnerable kernel versions.

Mitigation Strategies

Apply the latest Linux kernel security patches that include the fix for this vulnerability. If immediate patching is not possible, consider disabling Bluetooth functionality temporarily or restricting Bluetooth usage to trusted devices until the patch is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98107. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart