HIGH Introduced in 5.7
bluetooth ChanMode OOB
CVE-2026-98108
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
KernelScan AI8.8HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan l2cap_new_connection() sets default value of channel mode to match the parent channel. l2cap_le_connect_req() left this at the default, and created L2CAP_MODE_EXT_FLOWCTL channels if listening pchan has that mode. This causes FLAG_DEFER_SETUP channels to reply to L2CAP_LE_CONN_REQ with L2CAP_ECRED_CONN_RSP, which is incorrect. It can also result to stack OOB write (of l2cap_alloc_cid determined values) in l2cap_ecred_rsp_defer(), as l2cap_le_connect_req() does not limit maximum number of deferred channels or check for duplicate ident. Fix by setting chan->mode correctly in l2cap_le_connect_req(). Also check channel mode in l2cap_ecred_rsp_defer(), and do WARN_ON_ONCE instead of OOB write to make it less brittle.
02KernelScan AI Analysis
Risk summary
A remote attacker within Bluetooth range can exploit a stack out-of-bounds write in the L2CAP layer by sending crafted LE connection requests to a device with a listening channel using extended flow control mode. The overflow writes attacker-influenced values past a fixed-size stack buffer, enabling potential code execution or kernel crash. Any device with Bluetooth enabled and an affected listening channel is at risk.
Vulnerability analysis
When a Bluetooth Low Energy connection request arrives on a listening channel that uses extended flow control mode, the newly created channel incorrectly inherits the parent's mode instead of being set to the standard LE flow control mode. This causes deferred-setup channels to be routed through the wrong response path, where a fixed-size stack buffer collecting channel identifiers can be overflowed because the number of deferred channels sharing the same request identifier is not limited and duplicate identifiers are not checked. An attacker within Bluetooth range can send multiple connection requests to overflow this buffer, corrupting the kernel stack with values derived from allocated channel IDs. The fix sets the channel mode correctly at creation time so the wrong response path is never taken, and adds a bounds check that prevents the overflow if the condition is somehow still reached.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.10 | 5.7 | 5.10.271 | ad0f44a3f1f6 |
| 5.15 | 5.7 | 5.15.222 | 564ae0e05e59 |
| 6.1 | 5.7 | 6.1.189 | aab17938998b |
| 6.6 | 5.7 | 6.6.158 | 0e1fc7cab95a |
| 6.12 | 5.7 | 6.12.111 | 1074bcc57f74 |
| 6.18 | 5.7 | 6.18.53 | 5d5a625cbc85 |
| 7.2 | 5.7 | 7.2.7 | 6cb79e649922 |
| mainline | 5.7 | 7.3-rc2 | 4ef05db5b08b |
| cip/6.12 | 5.7 | 6.12.111-cip32 | 1074bcc57f74 |