SB20261022178 - Improper input validation in Linux kernel bluetooth rfcomm

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261022178

SB20261022178 - Improper input validation in Linux kernel bluetooth rfcomm

Published: October 22, 2026

Security Bulletin ID SB20261022178
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Adjecent network
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Improper input validation (CVE-ID: CVE-2026-98600)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker on the local network to cause RFCOMM header bytes to be delivered as application payload or interpreted as multiplexer control commands.

The vulnerability exists due to insufficient frame length validation in the Linux kernel's rfcomm_recv_frame() function when processing RFCOMM frames with an extended two-byte length field. A remote attacker on the local network can send a four-byte frame with EA set to zero and a valid frame check sequence to trigger an unchecked skb_pull() failure, leaving header bytes to be processed as application data or, on DLCI 0, as a multiplexer control command.


Remediation

Install update from vendor's website.

References