CVE-2026-98457

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: validate frame length before control and FCS access l2capdatarcv unpacks either a two-byte or four-byte control field without first ensuring that it is present. A short ERTM or streaming-mode frame can therefore...

CVE-2026-98457 Bluetooth: L2CAP: validate frame length before control and FCS access

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: validate frame length before control and FCS access l2capdatarcv unpacks either a two-byte or four-byte control field without first ensuring that it is present. A short ERTM or streaming-mode frame can therefore...

CVE-2026-98457

A vulnerability in the Linux kernel Bluetooth stack allows for an out-of-bounds read . The l2cap_data_rcv() function fails to verify the presence of two-byte or four-byte control fields before unpacking them, which can be triggered by short ERTM or streaming-mode frames. Additionally, when CRC16 ...

EUVD-2026-103697

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: validate frame length before control and FCS access l2capdatarcv unpacks either a two-byte or four-byte control field without first ensuring that it is present. A short ERTM or streaming-mode frame can therefore...