CVE-2026-90088
Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop rfcomm_apply_pn() accepts the MTU value from a remote PN (Parameter Negotiation) frame without checking for zero. When the remote peer sends an MTU of zero, d->mtu is set to 0. This causes the sendmsg path to enter an infinite loop when fragmenting data, as each fragment has size == min_t(size_t, len, 0) == 0, so the remaining length never decreases. The infinite allocation of zero-length skbs exhausts all system memory. Fix by clamping d->mtu to RFCOMM_DEFAULT_MTU when the negotiated value is zero, consistent with the initial value assigned in rfcomm_dlc_alloc().
How to fix
- Linux Linuxe7c0aa45ae6c5a338661b23812bfcdef50bf3e96, cbc2962da99b6b89345267d3aa74b4b573340548, 9b2e5f1928c99224345a9ed8c5dae5fc74964d6d, fc4851ff8dfb505e9a19efcc286712132bbd178d, f561e44261344adadf9d6a6dff31e3af9776d5c6, aeee917a4878af95f0c63e18c5f22eaf6299c7b8, 3988cbb1be501dbff909a2ee024670e3c955a66d, 44c98fd082eafd49d55a8a4077ff488175b2fe24 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 ≤ v < e7c0aa45ae6c5a338661b23812bfcdef50bf3e96, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 ≤ v < cbc2962da99b6b89345267d3aa74b4b573340548, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 ≤ v < 9b2e5f1928c99224345a9ed8c5dae5fc74964d6d, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 ≤ v < fc4851ff8dfb505e9a19efcc286712132bbd178d, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 ≤ v < f561e44261344adadf9d6a6dff31e3af9776d5c6, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 ≤ v < aeee917a4878af95f0c63e18c5f22eaf6299c7b8, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 ≤ v < 3988cbb1be501dbff909a2ee024670e3c955a66d, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 ≤ v < 44c98fd082eafd49d55a8a4077ff488175b2fe24, 2.6.12 | e7c0aa45ae6c5a338661b23812bfcdef50bf3e96, cbc2962da99b6b89345267d3aa74b4b573340548, 9b2e5f1928c99224345a9ed8c5dae5fc74964d6d, fc4851ff8dfb505e9a19efcc286712132bbd178d, f561e44261344adadf9d6a6dff31e3af9776d5c6, aeee917a4878af95f0c63e18c5f22eaf6299c7b8, 3988cbb1be501dbff909a2ee024670e3c955a66d, 44c98fd082eafd49d55a8a4077ff488175b2fe24 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.