Out-of-bounds read in Linux kernel - CVE-2026-98457

Vulnerability identifier: #VU156755

CSH Severity: Medium

CVSS v4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-98457

CWE-ID: CWE-125

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

The vulnerability allows a remote attacker on the local network to trigger out-of-bounds reads that may cause a denial of service or disclose kernel memory.

The vulnerability exists due to out-of-bounds reads in the Linux kernel Bluetooth L2CAP receive path when processing short ERTM or streaming-mode frames. A remote attacker on the local network can send a frame with an incomplete two-byte or four-byte control field, or an insufficient CRC16 frame check sequence, to trigger reads beyond the frame boundary. In the CRC16 case, subtracting two from the remaining length can wrap, leaving the buffer unchanged before the frame check sequence is read.

Linux kernel
Ubuntu
linux-nvidia-tegra (Ubuntu package)
linux-nvidia-tegra-igx (Ubuntu package)
linux-nvidia-tegra-5.15 (Ubuntu package)
linux (Ubuntu package)
linux-gcp (Ubuntu package)
linux-oracle (Ubuntu package)
linux-aws (Ubuntu package)
linux-ibm (Ubuntu package)
linux-hwe-7.0 (Ubuntu package)
linux-oem-7.0 (Ubuntu package)

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
linux-nvidia-tegra (Ubuntu package) - update to 5.15.0-1070.72
linux-nvidia-tegra-igx (Ubuntu package) - update to 5.15.0-1059.59
linux-nvidia-tegra-5.15 (Ubuntu package) - update to 5.15.0-1070.72~20.04.1
linux (Ubuntu package) - update to 7.0.0-42.42
linux-gcp (Ubuntu package) - update to 7.0.0-1016.18
linux-oracle (Ubuntu package) - update to 7.0.0-1015.16
linux-aws (Ubuntu package) - update to 7.0.0-1016.17
linux-ibm (Ubuntu package) - update to 7.0.0-1017.17
linux-hwe-7.0 (Ubuntu package) - update to 7.0.0-42.42~24.04.1
linux-oem-7.0 (Ubuntu package) - update to 7.0.0-1017.17

• https://git.kernel.org/stable/c/1fdbb2a712a9a162ee817c959740face80b3d929
• https://git.kernel.org/stable/c/3acf6a0038ec0d4e8f4dcbfc2a557dff5f61cb70
• https://git.kernel.org/stable/c/4373ba79a267947e771c438507f7b103e30bdb21
• https://git.kernel.org/stable/c/6c78a213d9070b610c7f418af2c25b66180b7e37
• https://git.kernel.org/stable/c/8c7556c7cd17e073bbefdc4a9a4694a207544c37
• https://git.kernel.org/stable/c/965bd88ed4b4763cb765dd65885adcfa588c6b14
• https://git.kernel.org/stable/c/c6a288e6001bcce16553c3853e0f5a45eaaf85c7
• https://git.kernel.org/stable/c/f557274af7b94b6134692e6f26b880f1e34c15bf

• Out-of-bounds read in Linux kernel bluetooth
• Ubuntu update for linux-oem-7.0
• Ubuntu update for linux, linux-aws, linux-gcp and more
• Ubuntu update for linux-nvidia-tegra, linux-nvidia-tegra-5.15, linux-nvidia-tegra-igx
• Ubuntu update for linux, linux-aws, linux-aws-5.15 and more