Cloudanix VulnDB

CVE-2026-98602

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A problem in how Linux handles certain Bluetooth network frames could let attackers peek at pieces of memory they should not see.

Exploitation
Adjacent Network
Attacker needs
None
Complexity
Moderate
Impact
Data Exposure
Component
OS kernel
Class
Information Disclosure
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Out-of-bounds heap reads in BNEP frame handlers allow access to uninitialized or adjacent kernel memory when processing short RX control frames or TX Ethernet headers without length validation, resulting in information disclosure.

Why it matters to the business

Potential leakage of kernel memory contents over Bluetooth connections on Linux systems, increasing risk of sensitive data exposure on devices handling Bluetooth PAN traffic; recent publication heightens need for rapid patching across server and embedded fleets.

How an attack unfolds

An attacker crafts malformed short BNEP control or AF_PACKET frames and sends them to a vulnerable Linux Bluetooth stack; the missing pskb_may_pull checks allow the kernel to read past the supplied data, disclosing heap contents before the corrected return or length guard prevents the access.

How to fix it

Apply the upstream kernel commit that adds pskb_may_pull guards in bnep_rx_frame, bnep_ctrl_frame, and bnep_net_xmit and corrects the BNEP_CONTROL fallthrough; rebuild and deploy the fixed kernel on all affected systems.

How to confirm the fix worked

Confirm kernel source contains the pskb_may_pull calls before header accesses and the explicit return after BNEP_CONTROL handling; test with crafted short frames to verify no OOB read occurs and monitor for stable behavior on Bluetooth PAN interfaces.

Typical attack path

  1. Establish Bluetooth connection or inject frames via L2CAP to reach BNEP layer
  2. Transmit short BNEP control frame lacking required header bytes or extension data
  3. Trigger bnep_rx_frame or bnep_ctrl_frame to perform unchecked reads
  4. Alternatively send short AF_PACKET TX frame with length below ETH_HLEN to bnep_net_xmit
  5. Observe or exfiltrate disclosed kernel memory contents

How to detect it

Review kernel logs for BNEP-related warnings or skb length checks around net/bluetooth/bnep/; inspect Bluetooth traffic captures for unusually short control or Ethernet frames; correlate with any process crashes or infoleak indicators in dmesg.

What your security team should do

  • Prioritize kernel updates on any Linux host exposing Bluetooth interfaces within the next patch cycle
  • Disable BNEP or Bluetooth PAN where not required until patches are applied
  • Add Bluetooth frame-length anomaly detection to host-based monitoring

The record

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough Fix multiple out-of-bounds reads in Bluetooth BNEP frame processing: 1. In bnep_rx_frame() and bnep_ctrl_frame() (net/bluetooth/bnep/core.c), use pskb_may_pull() to verify the BNEP header, control type byte, filter count, and extension headers exist before reading them, and return 0 after handling BNEP_CONTROL instead of falling through to Ethernet frame submission when no extension headers follow. 2. In bnep_net_xmit() (net/bluetooth/bnep/netdev.c), verify skb->len >= ETH_HLEN with pskb_may_pull() before reading the 14-byte Ethernet header to prevent an out-of-bounds heap read and infoleak on short AF_PACKET TX frames.

Affected packages

Ecosystem Package Introduced Fixed