CVE-2026-98457
Received Received - Intake

Bluetooth: L2CAP Frame Length Validation Flaw in Linux Kernel

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: validate frame length before control and FCS access l2cap_data_rcv() unpacks either a two-byte or four-byte control field without first ensuring that it is present. A short ERTM or streaming-mode frame can therefore cause an out-of-bounds read. There is a second short-frame case when CRC16 is enabled. After the control field is pulled, l2cap_check_fcs() subtracts two from skb->len without checking it. If fewer than two bytes remain, the subtraction wraps; skb_trim() leaves the buffer unchanged and the subsequent FCS load reads past the logical end of the frame. Validate that the frame contains both its control field and, when enabled, its FCS before either field is accessed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98457
EUVD
EUVD-2026-103697

Affected Vendors & Products

Showing 9 associated CPEs
Vendor Product Version / Range
Linux Linux 1c2acffb76d4bc5fd27c4ea55cc27ad8ead10f9a
Linux Linux 1c2acffb76d4bc5fd27c4ea55cc27ad8ead10f9a
Linux Linux 1c2acffb76d4bc5fd27c4ea55cc27ad8ead10f9a
Linux Linux 1c2acffb76d4bc5fd27c4ea55cc27ad8ead10f9a
Linux Linux 1c2acffb76d4bc5fd27c4ea55cc27ad8ead10f9a
Linux Linux 1c2acffb76d4bc5fd27c4ea55cc27ad8ead10f9a
Linux Linux 1c2acffb76d4bc5fd27c4ea55cc27ad8ead10f9a
Linux Linux 1c2acffb76d4bc5fd27c4ea55cc27ad8ead10f9a
Linux Linux 2.6.32

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the Linux kernel's Bluetooth L2CAP implementation. It involves improper validation of frame length before accessing control and FCS fields. A short frame can cause an out-of-bounds read, leading to potential memory corruption or crashes.

Impact Analysis

An attacker within Bluetooth range could exploit this to crash the system or potentially execute arbitrary code with kernel privileges. This may lead to denial of service or unauthorized access to sensitive data on affected systems.

Mitigation Strategies

Update the Linux kernel to the latest patched version to resolve the Bluetooth L2CAP frame validation issue.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98457. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart