All vulnerabilities
CVE-2026-98602

Linux: Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.21%Chance of exploitation activity in the next 30 days, higher than 10% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in7af80ad2cebfe2f1879d6a39a1aaa061d9c4e1caAlso 667aa703e11cdc237d169393bc6a5ea9acbb33c2, 3e605ff5932afe0970c2beca66f2f1ba2babe4dd and 3 moreCVE List
Published18 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 7af80ad2cebfe2f1879d6a39a1aaa061d9c4e1caLinuxCVE List
  • 667aa703e11cdc237d169393bc6a5ea9acbb33c2LinuxCVE List
  • 3e605ff5932afe0970c2beca66f2f1ba2babe4ddLinuxCVE List
  • 035f9b1809861967e58ce652680d70ea1502058fLinuxCVE List
  • 1e7aebc188f889b56c3aaeb6133ef6d77022c887LinuxCVE List
  • 8f31031326994d1abfcc6ebb6927ef96e51fb9ffLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough

Fix multiple out-of-bounds reads in Bluetooth BNEP frame processing:

  1. In bnep_rx_frame() and bnep_ctrl_frame() (net/bluetooth/bnep/core.c),

use pskb_may_pull() to verify the BNEP header, control type byte, filter count, and extension headers exist before reading them, and return 0 after handling BNEP_CONTROL instead of falling through to Ethernet frame submission when no extension headers follow.

  1. In bnep_net_xmit() (net/bluetooth/bnep/netdev.c), verify skb->len >=

ETH_HLEN with pskb_may_pull() before reading the 14-byte Ethernet header to prevent an out-of-bounds heap read and infoleak on short AF_PACKET TX frames.

Text from CVE List

Affected versions 18

  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 7af80ad2cebfe2f1879d6a39a1aaa061d9c4e1caCVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 667aa703e11cdc237d169393bc6a5ea9acbb33c2CVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 3e605ff5932afe0970c2beca66f2f1ba2babe4ddCVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 035f9b1809861967e58ce652680d70ea1502058fCVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 1e7aebc188f889b56c3aaeb6133ef6d77022c887CVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 8f31031326994d1abfcc6ebb6927ef96e51fb9ffCVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before ad0d2d4ada51321db787262ef343193c712b76b5CVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before f0ca020cbb9bb7f3f4ea8ba1dfcf30a282aec91eCVE List
  • Linuxaffected: 2.6.12CVE List
  • Linuxunaffected: all versions before 2.6.12CVE List
  • Linuxunaffected: 5.10.271 through 5.10.*CVE List
  • Linuxunaffected: 5.15.222 through 5.15.*CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.112 through 6.12.*CVE List
  • Linuxunaffected: 6.18.55 through 6.18.*CVE List
  • Linuxunaffected: 7.2.9 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 8