All vulnerabilities
CVE-2026-98107

Linux: Bluetooth: L2CAP: fix out-of-bounds write in l2cap_ecred_connect

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 5% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in6da5c0331fc3ef0c7b8df8269523fc3b2cce1e65Also 56c2b5831d39dc84aad2573dc3e197af1a872a05CVE List
Published25 Sep 2026Updated 21 Oct 2026CVE List

What fixes it

  • 6da5c0331fc3ef0c7b8df8269523fc3b2cce1e65LinuxCVE List
  • 56c2b5831d39dc84aad2573dc3e197af1a872a05LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: L2CAP: fix out-of-bounds write in l2cap_ecred_connect

l2cap_chan_connect() tries to ensure there are no more than L2CAP_ECRED_CONN_SCID_MAX pending ECRED channels, so they fit in the same L2CAP_ECRED_CONN_REQ that l2cap_ecred_connect() constructs.

However, the check only counts deferred channels. If 6 L2CAP sockets are connected at the same time in order DDDDND (D=deferred, N=non-deferred), the last can bump the total to max+1. It results to one __le16 written out of bounds of the scid array, and an invalid ECRED_CONN_REQ being sent.

Fix by leaving room for the non-deferred pending ECRED channels in the counting in l2cap_chan_connect(), so the limit can't be exceeded.

Move counting under same critical section where the channel is added. Although race conditions involving this appear unreachable, it's easier to see.

Also add WARN_ON_ONCE check in l2cap_ecred_defer_connect() to make this less brittle.

Text from CVE List

Affected versions 12

  • Linuxaffected: da49b602f7f75ccc91386e1274b3ef71676cd092 before fabc5e04f123225daf980d03f2c5a05e7f0f0a7fCVE List
  • Linuxaffected: da49b602f7f75ccc91386e1274b3ef71676cd092 before ce0927eb3ee2939fab5ce3f9334bfd2fafb38481CVE List
  • Linuxaffected: da49b602f7f75ccc91386e1274b3ef71676cd092 before 6da5c0331fc3ef0c7b8df8269523fc3b2cce1e65CVE List
  • Linuxaffected: da49b602f7f75ccc91386e1274b3ef71676cd092 before df8c3af6132640da4788e96a02d653e642059803CVE List
  • Linuxaffected: da49b602f7f75ccc91386e1274b3ef71676cd092 before 56c2b5831d39dc84aad2573dc3e197af1a872a05CVE List
  • Linuxaffected: 5.7CVE List
  • Linuxunaffected: all versions before 5.7CVE List
  • Linuxunaffected: 6.6.160 through 6.6.*CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2.7 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5