CVE-2026-98108
Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan l2cap_new_connection() sets default value of channel mode to match the parent channel. l2cap_le_connect_req() left this at the default, and created L2CAP_MODE_EXT_FLOWCTL channels if listening pchan has that mode. This causes FLAG_DEFER_SETUP channels to reply to L2CAP_LE_CONN_REQ with L2CAP_ECRED_CONN_RSP, which is incorrect. It can also result to stack OOB write (of l2cap_alloc_cid determined values) in l2cap_ecred_rsp_defer(), as l2cap_le_connect_req() does not limit maximum number of deferred channels or check for duplicate ident. Fix by setting chan->mode correctly in l2cap_le_connect_req(). Also check channel mode in l2cap_ecred_rsp_defer(), and do WARN_ON_ONCE instead of OOB write to make it less brittle.
How to fix
- Linux Linuxad0f44a3f1f688558ed876a0702bc2c82b0df689, 564ae0e05e598aa895b9dbd18cb7d6eb64752869, aab17938998b29e75c3324763411aef3e300fc67, 0e1fc7cab95ad958e55d70a5dfaaea687c9c639f, 1074bcc57f741223f9fa82ce6afe5c3d783e4d10, 5d5a625cbc854d4c4f68e4b16fcf6e682d9a9ed1, 6cb79e6499228cfdbd4b3301371ce74d01cd2f80, 4ef05db5b08b176a551b4a6287372045998806b0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 15f02b91056253e8cdc592888f431da0731337b8 ≤ v < ad0f44a3f1f688558ed876a0702bc2c82b0df689, 15f02b91056253e8cdc592888f431da0731337b8 ≤ v < 564ae0e05e598aa895b9dbd18cb7d6eb64752869, 15f02b91056253e8cdc592888f431da0731337b8 ≤ v < aab17938998b29e75c3324763411aef3e300fc67, 15f02b91056253e8cdc592888f431da0731337b8 ≤ v < 0e1fc7cab95ad958e55d70a5dfaaea687c9c639f, 15f02b91056253e8cdc592888f431da0731337b8 ≤ v < 1074bcc57f741223f9fa82ce6afe5c3d783e4d10, 15f02b91056253e8cdc592888f431da0731337b8 ≤ v < 5d5a625cbc854d4c4f68e4b16fcf6e682d9a9ed1, 15f02b91056253e8cdc592888f431da0731337b8 ≤ v < 6cb79e6499228cfdbd4b3301371ce74d01cd2f80, 15f02b91056253e8cdc592888f431da0731337b8 ≤ v < 4ef05db5b08b176a551b4a6287372045998806b0, 5.7 | ad0f44a3f1f688558ed876a0702bc2c82b0df689, 564ae0e05e598aa895b9dbd18cb7d6eb64752869, aab17938998b29e75c3324763411aef3e300fc67, 0e1fc7cab95ad958e55d70a5dfaaea687c9c639f, 1074bcc57f741223f9fa82ce6afe5c3d783e4d10, 5d5a625cbc854d4c4f68e4b16fcf6e682d9a9ed1, 6cb79e6499228cfdbd4b3301371ce74d01cd2f80, 4ef05db5b08b176a551b4a6287372045998806b0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.