Executive brief
A vulnerability was identified in the Linux kernel's Bluetooth subsystem that could allow a nearby attacker to cause a system crash. The issue occurs when the system processes specially crafted, shortened Bluetooth Network Encapsulation Protocol (BNEP) messages. This could lead to a denial-of-service condition, impacting the availability of devices using Bluetooth networking.
Technical details
An out-of-bounds read vulnerability exists in net/bluetooth/bnep/core.c within the bnep_rx_frame() and bnep_rx_control() functions. The issue stems from the code attempting to read packet type bytes, control opcodes, and UUID-size bytes from BNEP Service Data Units (SDUs) without first verifying that the packet is long enough to contain these fields. This leads to a slab-out-of-bounds read as confirmed by KASAN. The fix introduces skb_pull_data() to safely validate and extract fixed fields, ensuring that NULL returns gate further dereferences and that short frames are rejected before parsing.
Affected products
- Linux Linux kernel Introduced in 2.6.12-rc2; fixed in 6.9.6, 6.6.35, 6.1.95, 5.15.162, 5.10.221, 5.4.279, 4.19.317
Timeline
- 2026-05-29: other: Patch submitted by Zhang Cen
- 2026-06-25: advisory: CVE-2026-53253 published
References
- https://git.kernel.org/stable/c/0ef2ea86c82b2615902d085cd5a586fe9f58994f
- https://git.kernel.org/stable/c/2b83afb19293e4de700edae306115f18966dc4f9
- https://git.kernel.org/stable/c/6770d3a8acdf9151769180cc3710346c4cfbe6f0
- https://git.kernel.org/stable/c/691f14b6a48b637655755134f1e551c7c6fedc2e
- https://git.kernel.org/stable/c/be837cd09897e9e6e1958174501d467bdcbcc2bc
- https://git.kernel.org/stable/c/c893e17d2809ec9c4b3f1cdd5847cecbc27a311b
- https://git.kernel.org/stable/c/d76dec1a37122bc16d83d059c08c0512ea8de909