CVE-2026-98108
Description
A flaw was found in the Linux kernel's Bluetooth subsystem. When processing Bluetooth Low Energy connection requests in the Logical Link Control and Adaptation Protocol (L2CAP) layer, channel modes are incorrectly assigned during deferred connection handling. A nearby attacker within Bluetooth range could exploit this vulnerability by sending specially crafted connection requests to trigger an out-of-bounds write to stack memory. This issue primarily leads to a system crash and Denial of Service (DoS), or potentially arbitrary code execution.
Statement
An incorrect channel mode can cause an LE_CONN_REQ channel to inherit L2CAP_MODE_EXT_FLOWCTL from its listening parent instead of using L2CAP_MODE_LE_FLOWCTL. With deferred setup enabled, crafted or repeated Bluetooth LE connection requests can reach l2cap_ecred_rsp_defer() through the wrong protocol path. Missing limits on deferred channels and missing duplicate ident validation can then increase rsp count beyond the dcid array and cause a stack out of bounds write in kernel context. For the CVSS the PR:N is selected because a nearby Bluetooth peer does not need an account or local privileges on the target. AV:A is used because exploitation requires Bluetooth radio proximity and access to the affected L2CAP service rather than routable network access. AC:H reflects the required listening channel configuration, deferred setup state, and crafted request sequence. Impact is at least denial of service through kernel memory corruption. In the paranoid case the stack write may affect confidentiality and integrity or permit kernel code execution, although a reliable arbitrary write primitive is not established by the supplied code.
Mitigation
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.5 | N/A | 7.5 |
| Attack Vector | Adjacent Network | N/A | Adjacent Network |
| Attack Complexity | High | N/A | High |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
