CVE-2026-98107
Description
A flaw was found in the Linux kernel's Bluetooth subsystem. A local user can trigger an out-of-bounds memory write by establishing multiple concurrent Logical Link Control and Adaptation Protocol (L2CAP) connections. Due to improper channel limit verification, this flaw allows memory corruption that can lead to a Denial of Service (DoS) through a system crash.
Statement
A flaw of moderate impact was found in the Linux kernel's Bluetooth L2CAP implementation, affecting the kernels shipped in Red Hat Enterprise Linux 8, 9, and 10, Red Hat In-Vehicle OS, and the RHEL CoreOS images used by OpenShift Container Platform. When multiple L2CAP sockets are connected concurrently, l2cap_chan_connect() enforces the limit on pending Enhanced Credit Based flow control (ECRED) channels by counting only deferred channels. A local user with the ability to create Bluetooth sockets can connect six L2CAP sockets in a specific deferred/non-deferred order so that the pending channel count exceeds the limit by one, causing a 16-bit source channel ID to be written out of bounds of the scid array when l2cap_ecred_connect() builds the ECRED connection request. This out-of-bounds write corrupts kernel memory and can crash the kernel, resulting in a denial of service. Red Hat rated this flaw Moderate (CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because it requires local access to create Bluetooth L2CAP sockets and the demonstrated impact is loss of availability, with no demonstrated confidentiality or integrity impact. Red Hat Enterprise Linux 6 and 7 are not affected because the vulnerable code is not present in those releases. Fixes for the affected products are currently deferred; until a fix is released, the residual risk is that a local user able to establish Bluetooth L2CAP connections can trigger memory corruption and crash the kernel.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
