CVE-2026-98457
Description
A flaw was found in the Linux kernel's Bluetooth Logical Link Control and Adaptation Protocol (L2CAP) implementation. An adjacent attacker within Bluetooth range could exploit this vulnerability by transmitting specially crafted, undersized network frames. Because the kernel fails to validate packet length before processing control and Frame Check Sequence (FCS) fields, an out-of-bounds read occurs. This flaw primarily results in a system crash, leading to a Denial of Service (DoS), and may potentially expose sensitive kernel memory.
Statement
This vulnerability is rated as having a Moderate impact because exploitation requires adjacent physical proximity and an active Bluetooth interface on the host. In typical Red Hat Enterprise Linux server environments, Bluetooth adapters are absent or unconfigured by default, significantly reducing the attack surface. While processing maliciously crafted frames can crash the kernel and trigger a denial of service, an attacker cannot exploit this flaw remotely over a standard IP network.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.5 | N/A | N/A |
| Attack Vector | Adjacent Network | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | None | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
