Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-10-18T00:00:00 kernel: Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CWE-125

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough Fix multiple out-of-bounds reads in Bluetooth BNEP frame processing: 1. In bnep_rx_frame() and bnep_ctrl_frame() (net/bluetooth/bnep/core.c), use pskb_may_pull() to verify the BNEP header, control type byte, filter count, and extension headers exist before reading them, and return 0 after handling BNEP_CONTROL instead of falling through to Ethernet frame submission when no extension headers follow. 2. In bnep_net_xmit() (net/bluetooth/bnep/netdev.c), verify skb->len >= ETH_HLEN with pskb_may_pull() before reading the 14-byte Ethernet header to prevent an out-of-bounds heap read and infoleak on short AF_PACKET TX frames.

A flaw was found in the Linux kernel's Bluetooth Network Encapsulation Protocol (BNEP) implementation. Insufficient length validation when processing network frames allows out-of-bounds memory read operations. An attacker can exploit this vulnerability by transmitting malformed or truncated network frames, leading to a Denial of Service (DoS) via a system crash or information disclosure through leaked kernel memory.

This vulnerability is rated as having Moderate impact for Red Hat Enterprise Linux because exploitation is constrained to adjacent network proximity over Bluetooth and requires the system to have Bluetooth hardware actively running BNEP services. Default Red Hat Enterprise Linux server installations rarely enable Bluetooth interfaces or establish BNEP network sessions, which significantly restricts the practical attack surface. In environments where Bluetooth networking is enabled, an unauthenticated attacker within wireless range could trigger a kernel crash or leak sensitive kernel memory. Red Hat Enterprise Linux 10 Fix deferred kernel Red Hat Enterprise Linux 6 Out of support scope kernel Red Hat Enterprise Linux 7 Fix deferred kernel Red Hat Enterprise Linux 7 Fix deferred kernel-rt Red Hat Enterprise Linux 8 Fix deferred kernel Red Hat Enterprise Linux 8 Fix deferred kernel-rt Red Hat Enterprise Linux 9 Fix deferred kernel Red Hat Enterprise Linux 9 Fix deferred kernel-rt Red Hat OpenShift Container Platform 4 Fix deferred openshift/ose-rhel-coreos-8 Red Hat OpenShift Container Platform 4 Fix deferred openshift/ose-rhel-coreos-9 Red Hat OpenShift Container Platform 5 Fix deferred openshift/ose-rhel-coreos-9 https://www.cve.org/CVERecord?id=CVE-2026-98602 https://nvd.nist.gov/vuln/detail/CVE-2026-98602 https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98602.mbox