HIGH Introduced in 2.6.12
bluetooth RFCOMM OOB
CVE-2026-93783
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
01Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame rfcomm_recv_frame() casts skb->data to struct rfcomm_hdr and dereferences hdr->addr and hdr->ctrl without validating skb->len first. A truncated frame with skb->len less than the minimum header size causes an out-of-bounds read of uninitialized memory. Additionally, a zero-length frame causes skb->len-- to underflow to UINT_MAX, making skb_tail_pointer() read far past the buffer. Commit 23882b828c3c ("Bluetooth: RFCOMM: validate skb length in MCC handlers") fixed the same class of missing-length-check bugs in the MCC sub-handlers, but the top-level rfcomm_recv_frame() was left unfixed. KMSAN reports: BUG: KMSAN: uninit-value in rfcomm_run ... Uninit was created at: __alloc_skb+0x474/0xb60 vhci_write+0xe9/0x870 Fix this by rejecting frames smaller than sizeof(struct rfcomm_hdr) + 1 (the minimum frame must have a 3-byte header and a 1-byte FCS).
02KernelScan AI Analysis
Risk summary
This vulnerability affects any Linux system with Bluetooth enabled. An attacker within Bluetooth range can send a malformed RFCOMM frame to trigger an out-of-bounds memory read that can crash the kernel. The bug has existed since Linux 2.6.12 and requires no privileges on the target system when exploited over Bluetooth.
Vulnerability analysis
The RFCOMM Bluetooth protocol handler processes incoming frames without first verifying that the frame buffer is large enough to contain the minimum required header and checksum bytes. A malformed Bluetooth frame shorter than the minimum valid size causes the handler to read beyond the intended data — reading uninitialized memory from a truncated frame, or in the case of a zero-length frame, causing an integer underflow in the length field that makes a subsequent pointer calculation reference memory far past the buffer boundary. The fix adds a length check at the entry point of frame processing, rejecting any frame smaller than the minimum valid RFCOMM frame size before any header fields are accessed. The vulnerable code path is reachable over Bluetooth by any device within wireless range that can send RFCOMM frames, and can also be triggered locally through the virtual HCI testing interface with appropriate device access privileges.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.10 | 2.6.12 | 5.10.271 | fb40eda15122 |
| 5.15 | 2.6.12 | 5.15.222 | 3829af5fab5a |
| 6.1 | 2.6.12 | 6.1.189 | b161eacd7fa4 |
| 6.6 | 2.6.12 | 6.6.158 | 30d1d9f34954 |
| 6.12 | 2.6.12 | 6.12.111 | 67dc3b40fae7 |
| 6.18 | 2.6.12 | 6.18.53 | bbc310caa2b6 |
| mainline | 2.6.12 | 7.2 | b230e5bf501c |
| cip/6.12 | 2.6.12 | 6.12.111-cip32 | 67dc3b40fae7 |