CVE-2026-90088

A flaw was found in the Linux kernel's Bluetooth RFCOMM (Radio Frequency Communication) component. A remote attacker can exploit this by sending a specially crafted Parameter Negotiation (PN) frame with a zero Maximum Transmission Unit (MTU) value. This can lead to an infinite loop during data fragmentation, causing an unbounded allocation of memory and ultimately exhausting all system memory, resulting in a denial of service.

A moderate impact denial of service vulnerability was found in the Linux kernel Bluetooth RFCOMM implementation shipped in Red Hat Enterprise Linux (kernel and kernel-rt), Red Hat In-Vehicle OS, and the RHEL CoreOS container hosts used by OpenShift Container Platform 4. The rfcomm_apply_pn() function accepts the Maximum Transmission Unit (MTU) value from a remote peer's Parameter Negotiation (PN) frame without checking it for zero. A malicious peer that has an established Bluetooth RFCOMM session with the target can send a PN frame with a zero MTU, which sets the data link connection's MTU to zero and makes the sendmsg data fragmentation path loop indefinitely, allocating zero-length socket buffers until system memory is exhausted and the system becomes unavailable. The flaw affects availability only; it does not compromise confidentiality or integrity. Red Hat rated this flaw Moderate severity (CVSS 3.1 score 5.5, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), which is lower than assessments that model the Bluetooth radio link as an adjacent network vector, reflecting that exploitation requires an established RFCOMM connection with the attacking peer. Fixes for the affected Red Hat Enterprise Linux, Red Hat In-Vehicle OS, and OpenShift Container Platform streams have been deferred to future updates because the flaw is limited to denial of service; the residual risk is memory exhaustion and unavailability of systems that accept RFCOMM connections from untrusted Bluetooth peers. Red Hat Enterprise Linux 6 Extended Lifecycle Support is out of support and will not receive a fix.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Systems that do not require Bluetooth RFCOMM can mitigate this flaw by disabling Bluetooth or preventing the rfcomm kernel module from loading, for example by adding a file under /etc/modprobe.d/ containing 'install rfcomm /bin/true' and rebooting the system; where RFCOMM is built as a loadable module, this prevents any RFCOMM data link connection from being established and blocks the vulnerable code path. For deployments that require Bluetooth RFCOMM functionality, mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.