CVE-2026-97408

A flaw was found in the Linux kernel's Bluetooth subsystem. The Logical Link Control and Adaptation Protocol (L2CAP) implementation fails to properly validate the payload length of connectionless frames before reading the Protocol/Service Multiplexer (PSM) field. An adjacent attacker within Bluetooth range can exploit this flaw by transmitting a malformed packet with a truncated payload, causing the parser to read beyond the intended buffer. This out-of-bounds read may result in a system crash leading to a Denial of Service (DoS) or the potential disclosure of kernel memory.

A moderate-impact out-of-bounds read flaw was found in the Linux kernel's Bluetooth Logical Link Control and Adaptation Protocol (L2CAP) implementation. When processing a connectionless L2CAP frame, l2cap_recv_frame() in net/bluetooth/l2cap_core.c reads the two-byte Protocol/Service Multiplexer (PSM) field without first validating that the frame payload contains at least two bytes. An unauthenticated attacker within Bluetooth radio range of an affected system can send a malformed connectionless frame with a zero- or one-byte payload, causing the kernel to read beyond the advertised socket buffer (skb) payload and use tailroom bytes as part of the PSM. The most likely consequence is a kernel crash leading to denial of service. The out-of-bounds data is consumed internally for channel dispatch and is not returned to the attacker, so Red Hat's assessment rates the confidentiality impact as none, reflected in the CVSS 3.1 base score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H); this differs from the CVE description, which mentions potential disclosure of kernel memory. Only systems with the affected Bluetooth L2CAP code reachable over Bluetooth radio are exposed. The current Red Hat affectedness data marks 40 kernel product streams as affected and one as not affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.