CVE-2026-93783

A flaw was found in the Linux kernel's Bluetooth RFCOMM (Radio Frequency Communication) subsystem. This vulnerability allows an attacker within Bluetooth range to cause a Denial of Service (DoS) or trigger an information disclosure by transmitting specially crafted, truncated, or zero-length frames. Because the kernel fails to validate the packet buffer length before accessing frame headers, processing these malformed packets leads to an out-of-bounds memory read.

A Bluetooth RFCOMM frame parser can read beyond the skb buffer because rfcomm_recv_frame dereferences the RFCOMM header before validating the minimum skb length. A truncated frame can cause an out of bounds read of uninitialized kernel memory. A zero length frame can also underflow skb length and make skb_tail_pointer operate far beyond the original buffer. An attacker within Bluetooth range may trigger the issue by sending malformed RFCOMM traffic to a device that accepts the relevant connection. For the CVSS the PR:N metric is used because the trigger does not require local code execution or privileges on the target system. AV:A is used because Bluetooth proximity or equivalent access to the Bluetooth transport is required. The confirmed impact is at least denial of service through a possible kernel crash. For the paranoid score C:L is used because an out of bounds read of uninitialized memory is confirmed by KMSAN, but no direct information disclosure path or write primitive is demonstrated. Bluetooth pairing requirements and RFCOMM service policy may reduce practical exposure in many deployments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.