SB2026092887 - Stack-based buffer overflow in Linux kernel bluetooth

Description

This security bulletin contains information about 1 vulnerability.

1) Stack-based buffer overflow (CVE-ID: CVE-2026-98108)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 7.7 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause memory corruption.

The vulnerability exists due to a stack-based buffer overflow in the Bluetooth L2CAP deferred enhanced credit-based response handling when processing L2CAP LE connection requests. A remote attacker can send specially crafted L2CAP LE connection requests to cause memory corruption.

The issue involves deferred-setup channels and listening parent channels configured for extended flow control.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/1074bcc57f741223f9fa82ce6afe5c3d783e4d10
• https://git.kernel.org/stable/c/4ef05db5b08b176a551b4a6287372045998806b0
• https://git.kernel.org/stable/c/5d5a625cbc854d4c4f68e4b16fcf6e682d9a9ed1
• https://git.kernel.org/stable/c/6cb79e6499228cfdbd4b3301371ce74d01cd2f80