Executive brief
A vulnerability was identified in the Linux kernel's Bluetooth implementation. The issue exists in the RFCOMM protocol, which is used for emulating serial ports over Bluetooth. A malicious nearby device could send specially crafted, shortened messages to trigger an error that allows it to read data from the system's memory that it should not have access to.
Technical details
An out-of-bounds read vulnerability exists in the Linux kernel Bluetooth stack within the RFCOMM protocol. The MCC handlers (including PN, RPN, RLS, and MSC) cast socket buffer (skb) data to protocol-specific structures without first validating that the buffer length is sufficient to contain those structures. A malicious remote device within Bluetooth range can send truncated MCC frames to trigger these out-of-bounds reads. The fix introduces skb_pull_data() to validate and safely access the required data before dereferencing. Special handling was added for rfcomm_recv_rpn() to accommodate 1-byte RPN requests as permitted by ETSI TS 07.10.
Affected products
- Linux Linux 2.6.12 to 5.15.210, 6.1.176, 6.6.143, 6.12.94
Timeline
- 2026-06-25: disclosed
- 2026-06-25: advisory
References
- https://git.kernel.org/stable/c/08b9c1fbe78f4ad3f6250c6541cfaabdbeb81997
- https://git.kernel.org/stable/c/0d637136ce89f9a2309b2c3502402ce400dab0ef
- https://git.kernel.org/stable/c/1b070ac9e99c2c2c3a8112943ca98ab6fca7f10c
- https://git.kernel.org/stable/c/23882b828c3c8c51d0c946446a396b10abb3b16b
- https://git.kernel.org/stable/c/3eabc6d47a0ad22b053329997aaf0ec1e581e392
- https://git.kernel.org/stable/c/7c15c7c2878957cbfed93bcc29c13fdace464254
- https://git.kernel.org/stable/c/98377e6b1a1a56561ec66a181573ea2b61b2079e