Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-06-25T00:00:00 kernel: Bluetooth: RFCOMM: validate skb length in MCC handlers 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CWE-1284

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: validate skb length in MCC handlers The RFCOMM MCC handlers cast skb->data to protocol-specific structs without validating skb->len first. A malicious remote device can send truncated MCC frames and trigger out-of-bounds reads in these handlers. Fix this by using skb_pull_data() to validate and access the required data before dereferencing it. rfcomm_recv_rpn() requires special handling since ETSI TS 07.10 allows 1-byte RPN requests. Handle this by validating only the DLCI byte first, and validating the full struct only when len > 1.

A flaw was found in the Linux kernel's Bluetooth RFCOMM (Radio Frequency Communication) subsystem. A malicious remote device could exploit this vulnerability by sending specially crafted, truncated Multiplexing Control Channel (MCC) frames. This lack of proper validation of incoming data length before processing could lead to out-of-bounds reads, potentially resulting in information disclosure or a denial of service.

Red Hat Enterprise Linux 10 Affected kernel Red Hat Enterprise Linux 6 Out of support scope kernel Red Hat Enterprise Linux 7 Affected kernel Red Hat Enterprise Linux 7 Affected kernel-rt Red Hat Enterprise Linux 8 Affected kernel Red Hat Enterprise Linux 8 Affected kernel-rt Red Hat Enterprise Linux 9 Affected kernel Red Hat Enterprise Linux 9 Affected kernel-rt https://www.cve.org/CVERecord?id=CVE-2026-53254 https://nvd.nist.gov/vuln/detail/CVE-2026-53254 https://lore.kernel.org/linux-cve-announce/2026062514-CVE-2026-53254-82af@gregkh/T