CVE-2026-97408
Summary
by MITRE • 09/24/2026
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: L2CAP: validate connectionless PSM length
Connectionless L2CAP frames carry a two-byte PSM at the start of the payload. l2cap_recv_frame() currently reads that PSM unconditionally after validating only the outer L2CAP length.
A malformed connectionless frame with a zero- or one-byte payload can therefore make the parser read beyond the advertised skb payload and use tailroom bytes as part of the PSM. A VHCI-backed QEMU reproducer injected a one-byte connectionless payload and reached the unchecked read.
Reject connectionless frames that cannot contain the PSM before reading or pulling it. This preserves all valid connectionless frames while dropping only structurally incomplete packets.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/24/2026
The Linux kernel Bluetooth subsystem contains a critical input validation flaw within the Layer 2 Control and Adaptation Protocol (L2CAP) implementation, specifically affecting how connectionless data units are processed. L2CAP serves as an intermediate layer between higher-level protocols like RFCOMM or SDP and the underlying HCI transport, providing multiplexing of multiple logical connections over a single physical link. For connectionless communication modes, such as those used for broadcast or unreliable data transfer, each frame begins with a two-byte Protocol/Service Multiplexer (PSM) field that identifies the upper-layer protocol to which the payload should be delivered. The vulnerability arises in the l2cap_recv_frame function, which is responsible for parsing incoming L2CAP frames. While the code correctly validates the outer length of the L2CAP header and payload container, it fails to verify whether the actual payload size is sufficient to contain the mandatory two-byte PSM field before attempting to read it from the socket buffer (skb).
This oversight creates a classic out-of-bounds read condition that can be exploited by sending malformed connectionless frames with payloads of zero or one byte. When such a packet arrives, the parser proceeds to extract the PSM value without checking if two bytes are actually available in the payload region. Consequently, the kernel reads memory beyond the advertised end of the skb payload, potentially accessing tailroom bytes that belong to adjacent data structures or uninitialized memory regions within the network stack. This behavior constitutes an improper input validation error where the system assumes a fixed structure size regardless of the actual packet length provided by the sender. In practical scenarios, this flaw allows remote attackers who can inject Bluetooth packets into the communication channel to trigger unauthorized memory reads on the target device.
The operational impact of this vulnerability extends beyond simple information disclosure. By carefully crafting malformed frames and analyzing subsequent system behavior or crash dumps, an attacker may be able to leak sensitive kernel memory contents, which could include cryptographic keys, session tokens, or other private data residing in adjacent buffers. Furthermore, depending on the specific state of the network stack and memory layout at the time of exploitation, this out-of-bounds read could potentially lead to a denial of service by causing kernel panics or instability within the Bluetooth subsystem. Although direct code execution is less likely from a pure read vulnerability compared to write operations, the ability to probe arbitrary kernel memory significantly lowers the barrier for more complex attacks that leverage information leakage to bypass security mitigations such as KASLR (Kernel Address Space Layout Randomization).
From a threat modeling perspective, this flaw aligns with CWE-125, which describes Out-of-bounds Read vulnerabilities. It also maps to MITRE ATT&CK techniques related to Discovery and potentially Defense Evasion if the leaked information is used to identify system configurations or security controls. The vulnerability highlights the importance of strict boundary checking in network protocol parsers, particularly when dealing with variable-length fields that have fixed minimum size requirements. Attackers can exploit this via local Bluetooth interfaces or through remote wireless attacks if the device is discoverable and accepting connections from untrusted sources.
To mitigate this risk, system administrators should ensure that all Linux systems are updated to versions of the kernel where this validation logic has been corrected. The fix involves modifying the l2cap_recv_frame function to explicitly check that the payload length is at least two bytes before attempting to parse the PSM field. If the payload is shorter than required, the frame must be discarded immediately rather than processed further. This defensive programming approach ensures that structurally incomplete packets are dropped early in the processing pipeline, preventing any access to memory outside the allocated buffer boundaries. Users relying on Bluetooth connectivity for critical operations should prioritize applying these kernel updates and consider disabling unnecessary Bluetooth services if they are not actively required to reduce the attack surface available to potential adversaries exploiting this or similar protocol-level flaws.