{"id":"CVE-2026-98108","revision":"3031ad03991341cca9ada0e12c4de9d2","records":[{"revision":"3031ad03991341cca9ada0e12c4de9d2","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-98108","aliases":[],"title":"Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan\n\nl2cap_new_connection() sets default value of channel mode to match the\nparent channel.  l2cap_le_connect_req() left this at the default, and\ncreated L2CAP_MODE_EXT_FLOWCTL channels if listening pchan has that\nmode.  This causes FLAG_DEFER_SETUP channels to reply to\nL2CAP_LE_CONN_REQ with L2CAP_ECRED_CONN_RSP, which is incorrect.\n\nIt can also result to stack OOB write (of l2cap_alloc_cid determined\nvalues) in l2cap_ecred_rsp_defer(), as l2cap_le_connect_req() does not\nlimit maximum number of deferred channels or check for duplicate ident.\n\nFix by setting chan->mode correctly in l2cap_le_connect_req().\n\nAlso check channel mode in l2cap_ecred_rsp_defer(), and do WARN_ON_ONCE\ninstead of OOB write to make it less brittle.","state":0,"publishedAt":"2026-09-25T10:35:56.935+00:00","modifiedAt":"2026-10-19T09:14:00.739+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/bluetooth/l2cap_core.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"15f02b91056253e8cdc592888f431da0731337b8\",\n                            \"lessThan\": \"ad0f44a3f1f688558ed876a0702bc2c82b0df689\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"15f02b91056253e8cdc592888f431da0731337b8\",\n                            \"lessThan\": \"564ae0e05e598aa895b9dbd18cb7d6eb64752869\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"15f02b91056253e8cdc592888f431da0731337b8\",\n                            \"lessThan\": \"aab17938998b29e75c3324763411aef3e300fc67\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"15f02b91056253e8cdc592888f431da0731337b8\",\n                            \"lessThan\": \"0e1fc7cab95ad958e55d70a5dfaaea687c9c639f\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"15f02b91056253e8cdc592888f431da0731337b8\",\n                            \"lessThan\": \"1074bcc57f741223f9fa82ce6afe5c3d783e4d10\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"15f02b91056253e8cdc592888f431da0731337b8\",\n                            \"lessThan\": \"5d5a625cbc854d4c4f68e4b16fcf6e682d9a9ed1\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"15f02b91056253e8cdc592888f431da0731337b8\",\n                            \"lessThan\": \"6cb79e6499228cfdbd4b3301371ce74d01cd2f80\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"15f02b91056253e8cdc592888f431da0731337b8\",\n                            \"lessThan\": \"4ef05db5b08b176a551b4a6287372045998806b0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/bluetooth/l2cap_core.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"5.7\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"5.7\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.271\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.222\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.189\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.158\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.111\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.53\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.7\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","score":7.5,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/ad0f44a3f1f688558ed876a0702bc2c82b0df689","https://git.kernel.org/stable/c/564ae0e05e598aa895b9dbd18cb7d6eb64752869","https://git.kernel.org/stable/c/aab17938998b29e75c3324763411aef3e300fc67","https://git.kernel.org/stable/c/0e1fc7cab95ad958e55d70a5dfaaea687c9c639f","https://git.kernel.org/stable/c/1074bcc57f741223f9fa82ce6afe5c3d783e4d10","https://git.kernel.org/stable/c/5d5a625cbc854d4c4f68e4b16fcf6e682d9a9ed1","https://git.kernel.org/stable/c/6cb79e6499228cfdbd4b3301371ce74d01cd2f80","https://git.kernel.org/stable/c/4ef05db5b08b176a551b4a6287372045998806b0"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-98108","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-98108","identifiers":["CVE-2026-98108"]},"retained":false,"historicalAffected":[]}],"coverage":[]}