CVE-2026-98600
Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame() While rfcomm_recv_frame() verifies that skb->len is at least sizeof(*hdr) + 1 (4 bytes: 3-byte header + 1-byte FCS), an RFCOMM frame with an extended 2-byte length field (!__test_ea(hdr->len)) has a 4-byte header plus a 1-byte FCS (5 bytes minimum, sizeof(*hdr) + 2). When a 4-byte RFCOMM frame with EA == 0 arrives: 1. The initial skb->len < sizeof(*hdr) + 1 check passes (4 < 4 is false). 2. Trimming the FCS byte decrements skb->len to 3. 3. If __check_fcs() succeeds, skb_pull(skb, 4) fails (4 > 3) and returns NULL without advancing skb->data. 4. Because the return value of skb_pull() is ignored, the un-pulled 3-byte struct rfcomm_hdr remains at skb->data and is either queued as application payload via rfcomm_recv_data() or parsed as a multiplexer control command via rfcomm_recv_mcc() on DLCI 0. Fix this by extending the length check in rfcomm_recv_frame() to also require skb->len >= sizeof(*hdr) + 2 when !__test_ea(hdr->len).
How to fix
- Linux Linux76876fd26569302d26d91cbe8b75fa8e66cf8969, 97711b964877242933484989224a3c4c5d88a5ee, 7a1781a2f3a9667b3065d402d1f11986a2363e08, c25587fa26761e623198b4f47151fe79d09ccde6, 71ccacde407b7d8f0ef48974a0d2524602fd5c44, be00deee60044ffa820f9436415caeb665b2cda0, 9240fc1f2cde5331c61608da21b00394602ca762, 6d91041bb38b97e2feb625123cc0529d7b83a0e1, 6.12.112, 6.18.55 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | fb40eda15122f6b780228639c1ead6820340ff54 ≤ v < 76876fd26569302d26d91cbe8b75fa8e66cf8969, 3829af5fab5a22405bf1e7d69068c2ec0fce46ca ≤ v < 97711b964877242933484989224a3c4c5d88a5ee, b161eacd7fa4a2d765724b5504ac6cc388e48f80 ≤ v < 7a1781a2f3a9667b3065d402d1f11986a2363e08, 30d1d9f3495463f7c026e4c553127f79b486fcd6 ≤ v < c25587fa26761e623198b4f47151fe79d09ccde6, 67dc3b40fae71b6b11c71e7ff69bac0758818c05 ≤ v < 71ccacde407b7d8f0ef48974a0d2524602fd5c44, bbc310caa2b6bf5fe42896ba27da0fbc12e4ac51 ≤ v < be00deee60044ffa820f9436415caeb665b2cda0, b230e5bf501c5edaf2eb0991cb862ac142031d4b ≤ v < 9240fc1f2cde5331c61608da21b00394602ca762, b230e5bf501c5edaf2eb0991cb862ac142031d4b ≤ v < 6d91041bb38b97e2feb625123cc0529d7b83a0e1, 6.12.111 ≤ v < 6.12.112, 6.18.53 ≤ v < 6.18.55, 7.2 | 76876fd26569302d26d91cbe8b75fa8e66cf8969, 97711b964877242933484989224a3c4c5d88a5ee, 7a1781a2f3a9667b3065d402d1f11986a2363e08, c25587fa26761e623198b4f47151fe79d09ccde6, 71ccacde407b7d8f0ef48974a0d2524602fd5c44, be00deee60044ffa820f9436415caeb665b2cda0, 9240fc1f2cde5331c61608da21b00394602ca762, 6d91041bb38b97e2feb625123cc0529d7b83a0e1, 6.12.112, 6.18.55 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.