CVE-2026-90088

CVE-2026-90088 affects the Linux kernel Bluetooth RFCOMM subsystem. The function rfcomm_apply_pn() accepts an MTU value from a remote Parameter Negotiation (PN) frame without validating it against zero. When a remote peer sends an MTU of zero, the sendmsg path enters an infinite loop during data ...

CVE-2026-90088 Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Validate MTU in rfcommapplypn to prevent infinite loop rfcommapplypn accepts the MTU value from a remote PN Parameter Negotiation frame without checking for zero. When the remote peer sends an MTU of zero, d-mt...