Cloudanix VulnDB

CVE-2026-98457

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A problem in the way Linux handles incoming Bluetooth data could let a nearby attacker crash the system or peek at small amounts of memory it shouldn't.

Exploitation
Adjacent Network
Attacker needs
None
Complexity
Moderate
Impact
Data Exposure
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Out-of-bounds read in l2cap_data_rcv() when a short ERTM or streaming-mode L2CAP frame lacks sufficient bytes for the control field, or when CRC16/FCS processing subtracts from skb len without bounds checks causing wrap and subsequent read past the buffer.

Why it matters to the business

Linux Bluetooth stacks on servers, desktops, and embedded devices face risk of crashes or limited information disclosure from malformed frames; low immediate urgency given absent KEV listing and minimal EPSS but still requires attention on any system exposing Bluetooth.

How an attack unfolds

An attacker pairs or connects to a vulnerable Linux Bluetooth host and transmits crafted short L2CAP frames in ERTM or streaming mode (with or without FCS) that trigger the missing length checks, resulting in kernel memory reads beyond the skb.

How to fix it

Apply the upstream kernel commit that adds explicit frame-length validation for control fields and FCS before access in l2cap_data_rcv; rebuild and deploy updated kernel packages on all affected Linux distributions.

How to confirm the fix worked

Confirm presence of length checks before control/FCS access in l2cap_core.c; test with crafted short frames to verify no OOB access occurs; monitor kernel logs for related Bluetooth warnings after update.

Typical attack path

  1. Establish Bluetooth connection or send unsolicited L2CAP frames to target
  2. Transmit short ERTM/streaming frames missing bytes for control field or FCS
  3. Trigger OOB read in l2cap_data_rcv or l2cap_check_fcs
  4. Observe kernel oops, information leak, or denial of service

How to detect it

Review kernel logs for Bluetooth L2CAP oops or skb trim warnings; inspect network captures for anomalous short L2CAP frames; correlate with process crashes in bluetooth or kernel modules.

What your security team should do

  • Prioritize kernel updates on any Linux host with Bluetooth enabled or discoverable
  • Disable Bluetooth services where not required to reduce attack surface
  • Monitor EPSS and KEV updates for this issue given its recent publication
  • Audit Bluetooth usage in IoT and server fleets for prevalence of exposure

The record

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: validate frame length before control and FCS access l2cap_data_rcv() unpacks either a two-byte or four-byte control field without first ensuring that it is present. A short ERTM or streaming-mode frame can therefore cause an out-of-bounds read. There is a second short-frame case when CRC16 is enabled. After the control field is pulled, l2cap_check_fcs() subtracts two from skb->len without checking it. If fewer than two bytes remain, the subtraction wraps; skb_trim() leaves the buffer unchanged and the subsequent FCS load reads past the logical end of the frame. Validate that the frame contains both its control field and, when enabled, its FCS before either field is accessed.

Affected packages

Ecosystem Package Introduced Fixed