All vulnerabilities
CVE-2026-93783

Linux: Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 6% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in3829af5fab5a22405bf1e7d69068c2ec0fce46caAlso 30d1d9f3495463f7c026e4c553127f79b486fcd6, 67dc3b40fae71b6b11c71e7ff69bac0758818c05CVE List
Published24 Sep 2026Updated 3 Oct 2026CVE List

What fixes it

  • 3829af5fab5a22405bf1e7d69068c2ec0fce46caLinuxCVE List
  • 30d1d9f3495463f7c026e4c553127f79b486fcd6LinuxCVE List
  • 67dc3b40fae71b6b11c71e7ff69bac0758818c05LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame

rfcomm_recv_frame() casts skb->data to struct rfcomm_hdr and dereferences hdr->addr and hdr->ctrl without validating skb->len first. A truncated frame with skb->len less than the minimum header size causes an out-of-bounds read of uninitialized memory. Additionally, a zero-length frame causes skb->len-- to underflow to UINT_MAX, making skb_tail_pointer() read far past the buffer.

Commit 23882b828c3c ("Bluetooth: RFCOMM: validate skb length in MCC handlers") fixed the same class of missing-length-check bugs in the MCC sub-handlers, but the top-level rfcomm_recv_frame() was left unfixed. KMSAN reports:

BUG: KMSAN: uninit-value in rfcomm_run ... Uninit was created at: __alloc_skb+0x474/0xb60 vhci_write+0xe9/0x870

Fix this by rejecting frames smaller than sizeof(struct rfcomm_hdr) + 1 (the minimum frame must have a 3-byte header and a 1-byte FCS).

Text from CVE List

Affected versions 16

  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before fb40eda15122f6b780228639c1ead6820340ff54CVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 3829af5fab5a22405bf1e7d69068c2ec0fce46caCVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before b161eacd7fa4a2d765724b5504ac6cc388e48f80CVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 30d1d9f3495463f7c026e4c553127f79b486fcd6CVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 67dc3b40fae71b6b11c71e7ff69bac0758818c05CVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before bbc310caa2b6bf5fe42896ba27da0fbc12e4ac51CVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before b230e5bf501c5edaf2eb0991cb862ac142031d4bCVE List
  • Linuxaffected: 2.6.12CVE List
  • Linuxunaffected: all versions before 2.6.12CVE List
  • Linuxunaffected: 5.10.271 through 5.10.*CVE List
  • Linuxunaffected: 5.15.222 through 5.15.*CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2CVE List

References 7