All vulnerabilities
CVE-2026-98108

Linux: Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
7.5High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.24%Chance of exploitation activity in the next 30 days, higher than 14% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in564ae0e05e598aa895b9dbd18cb7d6eb64752869Also 0e1fc7cab95ad958e55d70a5dfaaea687c9c639f, 1074bcc57f741223f9fa82ce6afe5c3d783e4d10 and 3 moreCVE List
Published25 Sep 2026Updated 19 Oct 2026CVE List

What fixes it

  • 564ae0e05e598aa895b9dbd18cb7d6eb64752869LinuxCVE List
  • 0e1fc7cab95ad958e55d70a5dfaaea687c9c639fLinuxCVE List
  • 1074bcc57f741223f9fa82ce6afe5c3d783e4d10LinuxCVE List
  • 5d5a625cbc854d4c4f68e4b16fcf6e682d9a9ed1LinuxCVE List
  • 6cb79e6499228cfdbd4b3301371ce74d01cd2f80LinuxCVE List
  • 4ef05db5b08b176a551b4a6287372045998806b0LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan

l2cap_new_connection() sets default value of channel mode to match the parent channel. l2cap_le_connect_req() left this at the default, and created L2CAP_MODE_EXT_FLOWCTL channels if listening pchan has that mode. This causes FLAG_DEFER_SETUP channels to reply to L2CAP_LE_CONN_REQ with L2CAP_ECRED_CONN_RSP, which is incorrect.

It can also result to stack OOB write (of l2cap_alloc_cid determined values) in l2cap_ecred_rsp_defer(), as l2cap_le_connect_req() does not limit maximum number of deferred channels or check for duplicate ident.

Fix by setting chan->mode correctly in l2cap_le_connect_req().

Also check channel mode in l2cap_ecred_rsp_defer(), and do WARN_ON_ONCE instead of OOB write to make it less brittle.

Text from CVE List

Affected versions 18

  • Linuxaffected: 15f02b91056253e8cdc592888f431da0731337b8 before ad0f44a3f1f688558ed876a0702bc2c82b0df689CVE List
  • Linuxaffected: 15f02b91056253e8cdc592888f431da0731337b8 before 564ae0e05e598aa895b9dbd18cb7d6eb64752869CVE List
  • Linuxaffected: 15f02b91056253e8cdc592888f431da0731337b8 before aab17938998b29e75c3324763411aef3e300fc67CVE List
  • Linuxaffected: 15f02b91056253e8cdc592888f431da0731337b8 before 0e1fc7cab95ad958e55d70a5dfaaea687c9c639fCVE List
  • Linuxaffected: 15f02b91056253e8cdc592888f431da0731337b8 before 1074bcc57f741223f9fa82ce6afe5c3d783e4d10CVE List
  • Linuxaffected: 15f02b91056253e8cdc592888f431da0731337b8 before 5d5a625cbc854d4c4f68e4b16fcf6e682d9a9ed1CVE List
  • Linuxaffected: 15f02b91056253e8cdc592888f431da0731337b8 before 6cb79e6499228cfdbd4b3301371ce74d01cd2f80CVE List
  • Linuxaffected: 15f02b91056253e8cdc592888f431da0731337b8 before 4ef05db5b08b176a551b4a6287372045998806b0CVE List
  • Linuxaffected: 5.7CVE List
  • Linuxunaffected: all versions before 5.7CVE List
  • Linuxunaffected: 5.10.271 through 5.10.*CVE List
  • Linuxunaffected: 5.15.222 through 5.15.*CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2.7 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 8