CVE-2026-97408
Description
A flaw was found in the Linux kernel's Bluetooth subsystem. The Logical Link Control and Adaptation Protocol (L2CAP) implementation fails to properly validate the payload length of connectionless frames before reading the Protocol/Service Multiplexer (PSM) field. An adjacent attacker within Bluetooth range can exploit this flaw by transmitting a malformed packet with a truncated payload, causing the parser to read beyond the intended buffer. This out-of-bounds read may result in a system crash leading to a Denial of Service (DoS) or the potential disclosure of kernel memory.
Statement
A moderate-impact out-of-bounds read flaw was found in the Linux kernel's Bluetooth Logical Link Control and Adaptation Protocol (L2CAP) implementation. When processing a connectionless L2CAP frame, l2cap_recv_frame() in net/bluetooth/l2cap_core.c reads the two-byte Protocol/Service Multiplexer (PSM) field without first validating that the frame payload contains at least two bytes. An unauthenticated attacker within Bluetooth radio range of an affected system can send a malformed connectionless frame with a zero- or one-byte payload, causing the kernel to read beyond the advertised socket buffer (skb) payload and use tailroom bytes as part of the PSM. The most likely consequence is a kernel crash leading to denial of service. The out-of-bounds data is consumed internally for channel dispatch and is not returned to the attacker, so Red Hat's assessment rates the confidentiality impact as none, reflected in the CVSS 3.1 base score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H); this differs from the CVE description, which mentions potential disclosure of kernel memory. Only systems with the affected Bluetooth L2CAP code reachable over Bluetooth radio are exposed. The current Red Hat affectedness data marks 40 kernel product streams as affected and one as not affected.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
