CVE-2026-98600

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98600", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.359Z", "datePublished": "2026-10-18T15:19:12.864Z", "dateUpdated": "2026-10-19T09:22:26.711Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:22:26.711Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame()\n\nWhile rfcomm_recv_frame() verifies that skb->len is at least\nsizeof(*hdr) + 1 (4 bytes: 3-byte header + 1-byte FCS), an RFCOMM frame\nwith an extended 2-byte length field (!__test_ea(hdr->len)) has a 4-byte\nheader plus a 1-byte FCS (5 bytes minimum, sizeof(*hdr) + 2).\n\nWhen a 4-byte RFCOMM frame with EA == 0 arrives:\n1. The initial skb->len < sizeof(*hdr) + 1 check passes (4 < 4 is false).\n2. Trimming the FCS byte decrements skb->len to 3.\n3. If __check_fcs() succeeds, skb_pull(skb, 4) fails (4 > 3) and returns\n NULL without advancing skb->data.\n4. Because the return value of skb_pull() is ignored, the un-pulled\n 3-byte struct rfcomm_hdr remains at skb->data and is either queued as\n application payload via rfcomm_recv_data() or parsed as a multiplexer\n control command via rfcomm_recv_mcc() on DLCI 0.\n\nFix this by extending the length check in rfcomm_recv_frame() to also\nrequire skb->len >= sizeof(*hdr) + 2 when !__test_ea(hdr->len)."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/bluetooth/rfcomm/core.c"], "versions": [{"version": "fb40eda15122f6b780228639c1ead6820340ff54", "lessThan": "76876fd26569302d26d91cbe8b75fa8e66cf8969", "status": "affected", "versionType": "git"}, {"version": "3829af5fab5a22405bf1e7d69068c2ec0fce46ca", "lessThan": "97711b964877242933484989224a3c4c5d88a5ee", "status": "affected", "versionType": "git"}, {"version": "b161eacd7fa4a2d765724b5504ac6cc388e48f80", "lessThan": "7a1781a2f3a9667b3065d402d1f11986a2363e08", "status": "affected", "versionType": "git"}, {"version": "30d1d9f3495463f7c026e4c553127f79b486fcd6", "lessThan": "c25587fa26761e623198b4f47151fe79d09ccde6", "status": "affected", "versionType": "git"}, {"version": "67dc3b40fae71b6b11c71e7ff69bac0758818c05", "lessThan": "71ccacde407b7d8f0ef48974a0d2524602fd5c44", "status": "affected", "versionType": "git"}, {"version": "bbc310caa2b6bf5fe42896ba27da0fbc12e4ac51", "lessThan": "be00deee60044ffa820f9436415caeb665b2cda0", "status": "affected", "versionType": "git"}, {"version": "b230e5bf501c5edaf2eb0991cb862ac142031d4b", "lessThan": "9240fc1f2cde5331c61608da21b00394602ca762", "status": "affected", "versionType": "git"}, {"version": "b230e5bf501c5edaf2eb0991cb862ac142031d4b", "lessThan": "6d91041bb38b97e2feb625123cc0529d7b83a0e1", "status": "affected", "versionType": "git"}, {"version": "6.12.111", "lessThan": "6.12.112", "status": "affected", "versionType": "semver"}, {"version": "6.18.53", "lessThan": "6.18.55", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/bluetooth/rfcomm/core.c"], "versions": [{"version": "7.2", "status": "affected"}, {"version": "0", "lessThan": "7.2", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.112", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.55", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.9", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12.111", "versionEndExcluding": "6.12.112"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18.53", "versionEndExcluding": "6.18.55"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.2", "versionEndExcluding": "7.2.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.2", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/76876fd26569302d26d91cbe8b75fa8e66cf8969"}, {"url": "https://git.kernel.org/stable/c/97711b964877242933484989224a3c4c5d88a5ee"}, {"url": "https://git.kernel.org/stable/c/7a1781a2f3a9667b3065d402d1f11986a2363e08"}, {"url": "https://git.kernel.org/stable/c/c25587fa26761e623198b4f47151fe79d09ccde6"}, {"url": "https://git.kernel.org/stable/c/71ccacde407b7d8f0ef48974a0d2524602fd5c44"}, {"url": "https://git.kernel.org/stable/c/be00deee60044ffa820f9436415caeb665b2cda0"}, {"url": "https://git.kernel.org/stable/c/9240fc1f2cde5331c61608da21b00394602ca762"}, {"url": "https://git.kernel.org/stable/c/6d91041bb38b97e2feb625123cc0529d7b83a0e1"}], "title": "Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/bluetooth/rfcomm/core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "76876fd26569302d26d91cbe8b75fa8e66cf8969", "status": "affected", "version": "fb40eda15122f6b780228639c1ead6820340ff54", "versionType": "git"}, {"lessThan": "97711b964877242933484989224a3c4c5d88a5ee", "status": "affected", "version": "3829af5fab5a22405bf1e7d69068c2ec0fce46ca", "versionType": "git"}, {"lessThan": "7a1781a2f3a9667b3065d402d1f11986a2363e08", "status": "affected", "version": "b161eacd7fa4a2d765724b5504ac6cc388e48f80", "versionType": "git"}, {"lessThan": "c25587fa26761e623198b4f47151fe79d09ccde6", "status": "affected", "version": "30d1d9f3495463f7c026e4c553127f79b486fcd6", "versionType": "git"}, {"lessThan": "71ccacde407b7d8f0ef48974a0d2524602fd5c44", "status": "affected", "version": "67dc3b40fae71b6b11c71e7ff69bac0758818c05", "versionType": "git"}, {"lessThan": "be00deee60044ffa820f9436415caeb665b2cda0", "status": "affected", "version": "bbc310caa2b6bf5fe42896ba27da0fbc12e4ac51", "versionType": "git"}, {"lessThan": "9240fc1f2cde5331c61608da21b00394602ca762", "status": "affected", "version": "b230e5bf501c5edaf2eb0991cb862ac142031d4b", "versionType": "git"}, {"lessThan": "6d91041bb38b97e2feb625123cc0529d7b83a0e1", "status": "affected", "version": "b230e5bf501c5edaf2eb0991cb862ac142031d4b", "versionType": "git"}, {"lessThan": "6.12.112", "status": "affected", "version": "6.12.111", "versionType": "semver"}, {"lessThan": "6.18.55", "status": "affected", "version": "6.18.53", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/bluetooth/rfcomm/core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "7.2"}, {"lessThan": "7.2", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.112", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.55", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame()\n\nWhile rfcomm_recv_frame() verifies that skb->len is at least\nsizeof(*hdr) + 1 (4 bytes: 3-byte header + 1-byte FCS), an RFCOMM frame\nwith an extended 2-byte length field (!__test_ea(hdr->len)) has a 4-byte\nheader plus a 1-byte FCS (5 bytes minimum, sizeof(*hdr) + 2).\n\nWhen a 4-byte RFCOMM frame with EA == 0 arrives:\n1. The initial skb->len < sizeof(*hdr) + 1 check passes (4 < 4 is false).\n2. Trimming the FCS byte decrements skb->len to 3.\n3. If __check_fcs() succeeds, skb_pull(skb, 4) fails (4 > 3) and returns\n NULL without advancing skb->data.\n4. Because the return value of skb_pull() is ignored, the un-pulled\n 3-byte struct rfcomm_hdr remains at skb->data and is either queued as\n application payload via rfcomm_recv_data() or parsed as a multiplexer\n control command via rfcomm_recv_mcc() on DLCI 0.\n\nFix this by extending the length check in rfcomm_recv_frame() to also\nrequire skb->len >= sizeof(*hdr) + 2 when !__test_ea(hdr->len)."}], "id": "CVE-2026-98600", "lastModified": "2026-10-19T10:19:21.517", "metrics": {}, "published": "2026-10-18T16:17:12.707", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6d91041bb38b97e2feb625123cc0529d7b83a0e1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/71ccacde407b7d8f0ef48974a0d2524602fd5c44"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/76876fd26569302d26d91cbe8b75fa8e66cf8969"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7a1781a2f3a9667b3065d402d1f11986a2363e08"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9240fc1f2cde5331c61608da21b00394602ca762"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/97711b964877242933484989224a3c4c5d88a5ee"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/be00deee60044ffa820f9436415caeb665b2cda0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c25587fa26761e623198b4f47151fe79d09ccde6"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame()", "id": "2555020", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555020"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-130", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nBluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame()\nWhile rfcomm_recv_frame() verifies that skb->len is at least\nsizeof(*hdr) + 1 (4 bytes: 3-byte header + 1-byte FCS), an RFCOMM frame\nwith an extended 2-byte length field (!__test_ea(hdr->len)) has a 4-byte\nheader plus a 1-byte FCS (5 bytes minimum, sizeof(*hdr) + 2).\nWhen a 4-byte RFCOMM frame with EA == 0 arrives:\n1. The initial skb->len < sizeof(*hdr) + 1 check passes (4 < 4 is false).\n2. Trimming the FCS byte decrements skb->len to 3.\n3. If __check_fcs() succeeds, skb_pull(skb, 4) fails (4 > 3) and returns\nNULL without advancing skb->data.\n4. Because the return value of skb_pull() is ignored, the un-pulled\n3-byte struct rfcomm_hdr remains at skb->data and is either queued as\napplication payload via rfcomm_recv_data() or parsed as a multiplexer\ncontrol command via rfcomm_recv_mcc() on DLCI 0.\nFix this by extending the length check in rfcomm_recv_frame() to also\nrequire skb->len >= sizeof(*hdr) + 2 when !__test_ea(hdr->len).", "A flaw was found in the Linux kernel's Bluetooth RFCOMM (Radio Frequency Communication) subsystem. This vulnerability allows an adjacent attacker within Bluetooth range to cause a Denial of Service (DoS) by transmitting a specially crafted frame with an extended length field. Because the kernel fails to adequately validate the minimum length of these frames, internal buffer adjustments fail and the unstripped packet header is mistakenly processed as a command or application payload, leading to unexpected behavior or system disruption."], "name": "CVE-2026-98600", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98600\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98600\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98600.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[fb40eda15122f6b780228639c1ead6820340ff54,76876fd26569302d26d91cbe8b75fa8e66cf8969)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[3829af5fab5a22405bf1e7d69068c2ec0fce46ca,97711b964877242933484989224a3c4c5d88a5ee)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[b161eacd7fa4a2d765724b5504ac6cc388e48f80,7a1781a2f3a9667b3065d402d1f11986a2363e08)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[30d1d9f3495463f7c026e4c553127f79b486fcd6,c25587fa26761e623198b4f47151fe79d09ccde6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[67dc3b40fae71b6b11c71e7ff69bac0758818c05,71ccacde407b7d8f0ef48974a0d2524602fd5c44)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[bbc310caa2b6bf5fe42896ba27da0fbc12e4ac51,be00deee60044ffa820f9436415caeb665b2cda0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[b230e5bf501c5edaf2eb0991cb862ac142031d4b,9240fc1f2cde5331c61608da21b00394602ca762)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[b230e5bf501c5edaf2eb0991cb862ac142031d4b,6d91041bb38b97e2feb625123cc0529d7b83a0e1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.12.111,6.12.112)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.18.53,6.18.55)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.2"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,7.2)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.112,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.55,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.9,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc5,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-18T18:45:06.824872+00:00", "updated": "2026-10-22T22:00:15.020022+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}