CVE-2026-98108

A flaw was found in the Linux kernel's Bluetooth subsystem. When processing Bluetooth Low Energy connection requests in the Logical Link Control and Adaptation Protocol (L2CAP) layer, channel modes are incorrectly assigned during deferred connection handling. A nearby attacker within Bluetooth range could exploit this vulnerability by sending specially crafted connection requests to trigger an out-of-bounds write to stack memory. This issue primarily leads to a system crash and Denial of Service (DoS), or potentially arbitrary code execution.

An incorrect channel mode can cause an LE_CONN_REQ channel to inherit L2CAP_MODE_EXT_FLOWCTL from its listening parent instead of using L2CAP_MODE_LE_FLOWCTL. With deferred setup enabled, crafted or repeated Bluetooth LE connection requests can reach l2cap_ecred_rsp_defer() through the wrong protocol path. Missing limits on deferred channels and missing duplicate ident validation can then increase rsp count beyond the dcid array and cause a stack out of bounds write in kernel context. For the CVSS the PR:N is selected because a nearby Bluetooth peer does not need an account or local privileges on the target. AV:A is used because exploitation requires Bluetooth radio proximity and access to the affected L2CAP service rather than routable network access. AC:H reflects the required listening channel configuration, deferred setup state, and crafted request sequence. Impact is at least denial of service through kernel memory corruption. In the paranoid case the stack write may affect confidentiality and integrity or permit kernel code execution, although a reliable arbitrary write primitive is not established by the supplied code.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.