HIGH Introduced in 2.6.32
bluetooth L2CAP OOB
CVE-2026-98457
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
01Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: validate frame length before control and FCS access l2cap_data_rcv() unpacks either a two-byte or four-byte control field without first ensuring that it is present. A short ERTM or streaming-mode frame can therefore cause an out-of-bounds read. There is a second short-frame case when CRC16 is enabled. After the control field is pulled, l2cap_check_fcs() subtracts two from skb->len without checking it. If fewer than two bytes remain, the subtraction wraps; skb_trim() leaves the buffer unchanged and the subsequent FCS load reads past the logical end of the frame. Validate that the frame contains both its control field and, when enabled, its FCS before either field is accessed.
02KernelScan AI Analysis
Risk summary
A nearby attacker can send a malformed L2CAP frame over Bluetooth to trigger an out-of-bounds read in the kernel, potentially leaking kernel memory and causing a denial of service. No authentication or user interaction is required — only physical proximity to the target device.
Vulnerability analysis
The Bluetooth L2CAP receive handler processes incoming frames without first verifying that the frame contains the expected control field (two or four bytes depending on mode) and, when CRC16 is enabled, a two-byte frame check sequence. A maliciously truncated frame causes the kernel to read past the end of the socket buffer: the control-field unpacking reads missing bytes directly, and the FCS check subtracts two from the remaining length without a guard, allowing an unsigned integer wrap that makes the subsequent FCS load reach far beyond the buffer. The fix adds a minimum-length check that accounts for both the control-field size and the optional FCS before any field is accessed, causing short frames to be dropped safely. The vulnerability is reachable by any device in Bluetooth radio range that can establish an L2CAP connection; no local account, pairing, or user interaction is needed.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.10 | 2.6.32 | 5.10.271 | 4373ba79a267 |
| 5.15 | 2.6.32 | 5.15.222 | 965bd88ed4b4 |
| 6.1 | 2.6.32 | 6.1.189 | 3acf6a0038ec |
| 6.12 | 2.6.32 | 6.12.112 | 1fdbb2a712a9 |
| 6.18 | 2.6.32 | 6.18.55 | c6a288e6001b |
| 6.6 | 2.6.32 | 6.6.158 | 8c7556c7cd17 |
| 7.2 | 2.6.32 | 7.2.9 | f557274af7b9 |
| mainline | 2.6.32 | 7.3 | 6c78a213d907 |
| cip/5.10 | 2.6.32 | 5.10.271-cip78 | 4373ba79a267 |
| cip/6.1 | 2.6.32 | 6.1.189-cip61 | 3acf6a0038ec |
| cip/6.1-rt | 2.6.32 | 6.1.189-cip61-rt32 | 3acf6a0038ec |
| cip/6.12 | 2.6.32 | 6.12.112-cip33 | 1fdbb2a712a9 |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.112-cip33 |
| cip/6.1 | Fixed in 6.1.189-cip61 |
| cip/6.1-rt | Fixed in 6.1.189-cip61-rt32 |
| cip/5.10 | Fixed in 5.10.271-cip78 |
| cip/5.10-rt | Affected — no CIP fix yet (latest 5.10.268-cip77-rt34) |
| cip/4.19 | Affected — no CIP fix yet (latest 4.19.325-cip136) |
| cip/4.19-rt | Affected — no CIP fix yet (latest 4.19.325-cip136-rt50) |
| cip/4.4 | Affected — no CIP fix yet (latest 4.4.302-cip115) |
| cip/4.4-rt | Affected — no CIP fix yet (latest 4.4.302-cip115-rt63) |