{"id":"CVE-2026-98600","revision":"515c5a64ef494ea6bb259e204fe7c364","records":[{"revision":"515c5a64ef494ea6bb259e204fe7c364","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-98600","aliases":[],"title":"Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame()\n\nWhile rfcomm_recv_frame() verifies that skb->len is at least\nsizeof(*hdr) + 1 (4 bytes: 3-byte header + 1-byte FCS), an RFCOMM frame\nwith an extended 2-byte length field (!__test_ea(hdr->len)) has a 4-byte\nheader plus a 1-byte FCS (5 bytes minimum, sizeof(*hdr) + 2).\n\nWhen a 4-byte RFCOMM frame with EA == 0 arrives:\n1. The initial skb->len < sizeof(*hdr) + 1 check passes (4 < 4 is false).\n2. Trimming the FCS byte decrements skb->len to 3.\n3. If __check_fcs() succeeds, skb_pull(skb, 4) fails (4 > 3) and returns\n   NULL without advancing skb->data.\n4. Because the return value of skb_pull() is ignored, the un-pulled\n   3-byte struct rfcomm_hdr remains at skb->data and is either queued as\n   application payload via rfcomm_recv_data() or parsed as a multiplexer\n   control command via rfcomm_recv_mcc() on DLCI 0.\n\nFix this by extending the length check in rfcomm_recv_frame() to also\nrequire skb->len >= sizeof(*hdr) + 2 when !__test_ea(hdr->len).","state":0,"publishedAt":"2026-10-18T15:19:12.864+00:00","modifiedAt":"2026-10-19T09:22:26.711+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/bluetooth/rfcomm/core.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"fb40eda15122f6b780228639c1ead6820340ff54\",\n                            \"lessThan\": \"76876fd26569302d26d91cbe8b75fa8e66cf8969\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"3829af5fab5a22405bf1e7d69068c2ec0fce46ca\",\n                            \"lessThan\": \"97711b964877242933484989224a3c4c5d88a5ee\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"b161eacd7fa4a2d765724b5504ac6cc388e48f80\",\n                            \"lessThan\": \"7a1781a2f3a9667b3065d402d1f11986a2363e08\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"30d1d9f3495463f7c026e4c553127f79b486fcd6\",\n                            \"lessThan\": \"c25587fa26761e623198b4f47151fe79d09ccde6\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"67dc3b40fae71b6b11c71e7ff69bac0758818c05\",\n                            \"lessThan\": \"71ccacde407b7d8f0ef48974a0d2524602fd5c44\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"bbc310caa2b6bf5fe42896ba27da0fbc12e4ac51\",\n                            \"lessThan\": \"be00deee60044ffa820f9436415caeb665b2cda0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"b230e5bf501c5edaf2eb0991cb862ac142031d4b\",\n                            \"lessThan\": \"9240fc1f2cde5331c61608da21b00394602ca762\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"b230e5bf501c5edaf2eb0991cb862ac142031d4b\",\n                            \"lessThan\": \"6d91041bb38b97e2feb625123cc0529d7b83a0e1\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"6.12.111\",\n                            \"lessThan\": \"6.12.112\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.53\",\n                            \"lessThan\": \"6.18.55\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/bluetooth/rfcomm/core.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"7.2\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"7.2\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.112\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.55\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.9\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/76876fd26569302d26d91cbe8b75fa8e66cf8969","https://git.kernel.org/stable/c/97711b964877242933484989224a3c4c5d88a5ee","https://git.kernel.org/stable/c/7a1781a2f3a9667b3065d402d1f11986a2363e08","https://git.kernel.org/stable/c/c25587fa26761e623198b4f47151fe79d09ccde6","https://git.kernel.org/stable/c/71ccacde407b7d8f0ef48974a0d2524602fd5c44","https://git.kernel.org/stable/c/be00deee60044ffa820f9436415caeb665b2cda0","https://git.kernel.org/stable/c/9240fc1f2cde5331c61608da21b00394602ca762","https://git.kernel.org/stable/c/6d91041bb38b97e2feb625123cc0529d7b83a0e1"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-98600","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-98600","identifiers":["CVE-2026-98600"]},"retained":false,"historicalAffected":[]}],"coverage":[]}