All vulnerabilities
CVE-2026-97408

Linux: Bluetooth: L2CAP: validate connectionless PSM length

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 6% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in8104cd9859b6de0826cffa68adf2c1461185823bAlso 9448e6f693fcf1f0ac4ee648a9b2cc83bfe4a982, 22fc1ce4e37c81d4e7aac01566ebdc232214540d and 2 moreCVE List
Published24 Sep 2026Updated 3 Oct 2026CVE List

What fixes it

  • 8104cd9859b6de0826cffa68adf2c1461185823bLinuxCVE List
  • 9448e6f693fcf1f0ac4ee648a9b2cc83bfe4a982LinuxCVE List
  • 22fc1ce4e37c81d4e7aac01566ebdc232214540dLinuxCVE List
  • 72e26293a231f63a856340d3a1f0f5fc29bf87e5LinuxCVE List
  • 3502ede8aed3c3ee1786d952a11054ac737d1a38LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: L2CAP: validate connectionless PSM length

Connectionless L2CAP frames carry a two-byte PSM at the start of the payload. l2cap_recv_frame() currently reads that PSM unconditionally after validating only the outer L2CAP length.

A malformed connectionless frame with a zero- or one-byte payload can therefore make the parser read beyond the advertised skb payload and use tailroom bytes as part of the PSM. A VHCI-backed QEMU reproducer injected a one-byte connectionless payload and reached the unchecked read.

Reject connectionless frames that cannot contain the PSM before reading or pulling it. This preserves all valid connectionless frames while dropping only structurally incomplete packets.

Text from CVE List

Affected versions 16

  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 8104cd9859b6de0826cffa68adf2c1461185823bCVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 9448e6f693fcf1f0ac4ee648a9b2cc83bfe4a982CVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 22fc1ce4e37c81d4e7aac01566ebdc232214540dCVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 72e26293a231f63a856340d3a1f0f5fc29bf87e5CVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 3502ede8aed3c3ee1786d952a11054ac737d1a38CVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before ae69dca122f6d6046a68cf40153e6e827c77ff5cCVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before a40a5f922546b3bd7c094d882b29177db4f2abe0CVE List
  • Linuxaffected: 2.6.12CVE List
  • Linuxunaffected: all versions before 2.6.12CVE List
  • Linuxunaffected: 5.10.271 through 5.10.*CVE List
  • Linuxunaffected: 5.15.222 through 5.15.*CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2CVE List

References 7