bluetooth L2CAP PSM OOB

Vulnerability analysis

The Bluetooth L2CAP parser assumes every connectionless frame contains at least a two-byte channel identifier at the start of its payload, but it never verifies this. When a malformed frame arrives with a payload smaller than two bytes, the parser reads past the end of the valid data, picking up whatever bytes happen to be next in memory as the identifier. It also advances its position in the buffer beyond what actually exists, which corrupts the packet's recorded size. As a result, any further handling of the frame can operate on a far larger buffer than is real, reading well outside the original packet boundaries. This can leak kernel memory and, because the read is unbounded, eventually touch unmapped pages and crash the system. The fix rejects any connectionless frame that is too short to hold the identifier before attempting to read or move past it, dropping only structurally incomplete packets while preserving all valid ones. The vulnerable path is reached whenever the kernel receives a Bluetooth L2CAP connectionless frame, which any device within Bluetooth radio range can send without authentication; it can also be triggered locally through a virtual HCI interface.