CVE-2026-53253

A flaw was found in the Linux kernel's Bluetooth Network Encapsulation Protocol (BNEP) component. A remote Bluetooth BNEP peer can exploit this vulnerability by sending a malformed short frame, leading to a slab out-of-bounds read. This can cause a kernel crash, resulting in a Denial of Service (DoS), and potentially lead to limited information disclosure.

A short BNEP SDU can reach bnep_rx_frame before the parser has proven that the fixed fields are present. The code reads the packet type byte and for control packets also reads the control opcode and setup UUID size byte before sufficient length validation, which can trigger a slab out of bounds read in kernel Bluetooth packet parsing. A remote Bluetooth BNEP peer can trigger this by sending a malformed short frame, causing a kernel crash or KASAN report. For the CVSS the PR:N is used because no local user access on the target is required once the attacker can act as a Bluetooth BNEP peer. The issue is adjacent network reachable rather than Internet reachable because Bluetooth proximity and BNEP connectivity are required. Impact is primarily denial of service. For the paranoid score, limited confidentiality impact is kept because the primitive is an out of bounds read, but there is no evidence of an out of bounds write or UAF based privilege escalation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.