Executive brief
The Linux kernel's Bluetooth RFCOMM protocol handler fails to validate the Maximum Transmission Unit (MTU) parameter negotiated with remote devices. A malicious or compromised Bluetooth peer can send a zero MTU value, causing the kernel to enter an infinite loop during data transmission that exhausts all system memory and crashes the device.
Technical details
The vulnerability exists in the rfcomm_apply_pn() function in net/bluetooth/rfcomm/core.c, which processes Parameter Negotiation (PN) frames from remote Bluetooth devices without validating that the MTU is non-zero. When a zero MTU is set, the sendmsg path attempts to fragment outgoing data using a fragment size of min_t(size_t, len, 0) == 0, causing an infinite loop since the remaining length never decreases. This results in unbounded allocation of zero-length socket buffers (skbs), exhausting available kernel memory. The attack requires the victim device to accept or initiate a Bluetooth connection with the attacker's device. A patch clamps the MTU to RFCOMM_DEFAULT_MTU when a zero value is negotiated, consistent with initial DLC allocation behavior.
Affected products
- Linux Linux kernel 2.6.12 and later (prior to patch)
Timeline
- 2026-09-17: disclosed: Published to NVD
- 2026-03-20: patched: Fix committed upstream (44c98fd082eafd49d55a8a4077ff488175b2fe24)