Executive brief
A vulnerability in the Linux kernel's Bluetooth subsystem could allow an attacker within radio range to overwhelm a device with network traffic. By sending specially crafted Bluetooth signaling packets, an unauthenticated attacker can force the target system to generate a large volume of response messages. This can lead to degraded performance or a temporary denial of service for Bluetooth operations.
Technical details
The l2cap_sig_channel() function in net/bluetooth/l2cap_core.c accepts BR/EDR signaling packets up to the general channel MTU rather than enforcing the specific signaling MTU (MTUsig). An unauthenticated attacker within Bluetooth radio range can send a single 681-byte signaling packet containing multiple packed L2CAP_ECHO_REQ commands. Because the kernel dispatches each command without checking the aggregate signaling MTU, it will generate a corresponding L2CAP_ECHO_RSP for every request in the packet, leading to a traffic amplification/denial-of-service condition. The fix enforces the spec-minimum MTUsig of 48 bytes and rejects oversized packets before command dispatch.
Affected products
- Linux Linux Kernel All versions prior to fix
Timeline
- 2026-06-25: disclosed
- 2026-06-25: advisory
References
- https://git.kernel.org/stable/c/214a2042b16b3c8d798a8b9ef9f36094f13a9859
- https://git.kernel.org/stable/c/a8335f3db15bd1e0e82e0db5d488fabc7d10d1ab
- https://git.kernel.org/stable/c/b20e8a98dd29b121f58fcdf51e8576119aba536a
- https://git.kernel.org/stable/c/dd214733544427587a95f66dbf3adff072568990
- https://git.kernel.org/stable/c/dedc92b96dc1d8919a3bdf2495ede68922ef7ebc
- https://git.kernel.org/stable/c/e05c4ac575b457978a7ef441053394169084869c
- https://git.kernel.org/stable/c/e2b8acf9405bd9b1baf1c54dc897b0905db689bf