{"schema":"threatline.record/2","record":{"id":"CVE-2026-98108","aliases":[],"summary":"Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan\n\nl2cap_new_connection() sets default value of channel mode to match the\nparent channel.  l2cap_le_connect_req() left this at the default, and\ncreated L2CAP_MODE_EXT_FLOWCTL channels if listening pchan has that\nmode.  This causes FLAG_DEFER_SETUP channels to reply to\nL2CAP_LE_CONN_REQ with L2CAP_ECRED_CONN_RSP, which is incorrect.\n\nIt can also result to stack OOB write (of l2cap_alloc_cid determined\nvalues) in l2cap_ecred_rsp_defer(), as l2cap_le_connect_req() does not\nlimit maximum number of deferred channels or check for duplicate ident.\n\nFix by setting chan->mode correctly in l2cap_le_connect_req().\n\nAlso check channel mode in l2cap_ecred_rsp_defer(), and do WARN_ON_ONCE\ninstead of OOB write to make it less brittle.","categories":["Operating systems"],"product":"Linux","vendor":"Linux","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98108","source_modified_at":"2026-10-19T09:14:00.739Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"Linux","vendor":"Linux","versions":[{"version":"15f02b91056253e8cdc592888f431da0731337b8","lessThan":"ad0f44a3f1f688558ed876a0702bc2c82b0df689","status":"affected","versionType":"git"},{"version":"15f02b91056253e8cdc592888f431da0731337b8","lessThan":"564ae0e05e598aa895b9dbd18cb7d6eb64752869","status":"affected","versionType":"git"},{"version":"15f02b91056253e8cdc592888f431da0731337b8","lessThan":"aab17938998b29e75c3324763411aef3e300fc67","status":"affected","versionType":"git"},{"version":"15f02b91056253e8cdc592888f431da0731337b8","lessThan":"0e1fc7cab95ad958e55d70a5dfaaea687c9c639f","status":"affected","versionType":"git"},{"version":"15f02b91056253e8cdc592888f431da0731337b8","lessThan":"1074bcc57f741223f9fa82ce6afe5c3d783e4d10","status":"affected","versionType":"git"},{"version":"15f02b91056253e8cdc592888f431da0731337b8","lessThan":"5d5a625cbc854d4c4f68e4b16fcf6e682d9a9ed1","status":"affected","versionType":"git"},{"version":"15f02b91056253e8cdc592888f431da0731337b8","lessThan":"6cb79e6499228cfdbd4b3301371ce74d01cd2f80","status":"affected","versionType":"git"},{"version":"15f02b91056253e8cdc592888f431da0731337b8","lessThan":"4ef05db5b08b176a551b4a6287372045998806b0","status":"affected","versionType":"git"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98108","source_modified_at":"2026-10-19T09:14:00.739Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"Linux","vendor":"Linux","versions":[{"version":"5.7","status":"affected"},{"version":"0","lessThan":"5.7","status":"unaffected","versionType":"semver"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","status":"unaffected","versionType":"semver"},{"version":"7.3","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}],"defaultStatus":"affected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98108","source_modified_at":"2026-10-19T09:14:00.739Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"564ae0e05e598aa895b9dbd18cb7d6eb64752869","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98108","source_modified_at":"2026-10-19T09:14:00.739Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"0e1fc7cab95ad958e55d70a5dfaaea687c9c639f","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98108","source_modified_at":"2026-10-19T09:14:00.739Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"1074bcc57f741223f9fa82ce6afe5c3d783e4d10","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98108","source_modified_at":"2026-10-19T09:14:00.739Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"5d5a625cbc854d4c4f68e4b16fcf6e682d9a9ed1","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98108","source_modified_at":"2026-10-19T09:14:00.739Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"6cb79e6499228cfdbd4b3301371ce74d01cd2f80","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98108","source_modified_at":"2026-10-19T09:14:00.739Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"4ef05db5b08b176a551b4a6287372045998806b0","basis":"first unaffected version stated in the CVE record"}],"cvss":7.5,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00245,"percentile":0.14883,"score_date":"2026-10-23"},"published_at":"2026-09-25T10:35:56.935Z","modified_at":"2026-10-19T09:14:00.739Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-98108","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-19T09:14:00.739Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98108","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://git.kernel.org/stable/c/ad0f44a3f1f688558ed876a0702bc2c82b0df689"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/564ae0e05e598aa895b9dbd18cb7d6eb64752869"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/aab17938998b29e75c3324763411aef3e300fc67"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/0e1fc7cab95ad958e55d70a5dfaaea687c9c639f"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/1074bcc57f741223f9fa82ce6afe5c3d783e4d10"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/5d5a625cbc854d4c4f68e4b16fcf6e682d9a9ed1"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/6cb79e6499228cfdbd4b3301371ce74d01cd2f80"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/4ef05db5b08b176a551b4a6287372045998806b0"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-19T09:14:00.739Z","content_hash":"6af512d8306b206f9d040bd3a73f78aad3bc8cabcf4cd2c3c9a4ee6358c97c20"}}