CVE-2026-98108

Awaiting Analysis Awaiting Analysis - Queue

Bluetooth Channel Mode Flaw in Linux Kernel

Publication date: 2026-09-25

Last updated on: 2026-10-03

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan l2cap_new_connection() sets default value of channel mode to match the parent channel. l2cap_le_connect_req() left this at the default, and created L2CAP_MODE_EXT_FLOWCTL channels if listening pchan has that mode. This causes FLAG_DEFER_SETUP channels to reply to L2CAP_LE_CONN_REQ with L2CAP_ECRED_CONN_RSP, which is incorrect. It can also result to stack OOB write (of l2cap_alloc_cid determined values) in l2cap_ecred_rsp_defer(), as l2cap_le_connect_req() does not limit maximum number of deferred channels or check for duplicate ident. Fix by setting chan->mode correctly in l2cap_le_connect_req(). Also check channel mode in l2cap_ecred_rsp_defer(), and do WARN_ON_ONCE instead of OOB write to make it less brittle.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-10-03

Generated

2026-10-16

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-98108

EUVD

EUVD-2026-86939

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a Linux kernel Bluetooth vulnerability where the L2CAP channel mode is incorrectly set during LE_CONN_REQ with EXT_FLOWCTL. It causes improper responses to connection requests and potential out-of-bounds memory writes due to unchecked deferred channels and duplicate identifiers.

Detection Guidance

This vulnerability is specific to the Linux kernel's Bluetooth L2CAP implementation. Detection requires checking kernel logs for Bluetooth-related errors or stack traces related to L2CAP channel handling. Monitor for crashes or unexpected behavior in Bluetooth operations. No direct commands are provided in the context, but kernel logs (dmesg, journalctl) may show relevant errors.

Impact Analysis

An attacker within Bluetooth range could exploit this to cause system crashes, memory corruption, or unauthorized code execution on affected Linux systems using vulnerable Bluetooth stacks.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it pertains to a Bluetooth stack issue in the Linux kernel. Compliance impacts would depend on system-specific implementations and data processing activities rather than this technical flaw.

Mitigation Strategies

Apply the Linux kernel patch that resolves this issue. Update to a kernel version containing the fix for the L2CAP channel mode handling in Bluetooth. If immediate patching is not possible, disable Bluetooth functionality temporarily until the patch is applied.

Hi! I’m here to help you understand CVE-2026-98108. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70