CVE-2026-53208 - Vulnerability Details

- Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig

net/bluetooth/l2cap_core.c:l2cap_sig_channel() accepts BR/EDR
signaling packets up to the channel MTU and dispatches each command
without enforcing the signaling MTU (MTUsig). A Bluetooth BR/EDR peer
within radio range can send a fixed-channel CID 0x0001 packet that is
larger than MTUsig and contains many L2CAP_ECHO_REQ commands before
pairing. In a real-radio stock-kernel run, one 681-byte signaling
packet containing 168 zero-length ECHO_REQ commands made the target
transmit 168 ECHO_RSP frames over about 220 ms.

Impact: a Bluetooth BR/EDR peer within radio range, before pairing, can
force 168 ECHO_RSP frames from one 681-byte fixed-channel signaling
packet containing packed ECHO_REQ commands.

Define Linux's BR/EDR signaling MTU as the spec minimum of 48 bytes and
reject any larger signaling packet with one L2CAP_COMMAND_REJECT_RSP
carrying L2CAP_REJ_MTU_EXCEEDED before any command is dispatched.

The Bluetooth Core spec wording for MTUExceeded says the reject
identifier shall match the first request command in the packet, and
that packets containing only responses shall be silently discarded.
Linux intentionally deviates from that prescription: silently
discarding desynchronizes the peer because the remote stack never
learns its responses were dropped, and locating the first request
command requires walking command headers past MTUsig, i.e. processing
bytes from a packet we have already decided is too large to process.
We therefore always emit one reject and use the identifier from the
first command header, a single fixed-offset byte read.

The unrestricted BR/EDR signaling parser and ECHO_REQ response path both
trace to the initial git import; no later introducing commit is
available for a Fixes tag.

Published: 2026-06-25

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel’s Bluetooth L2CAP stack fails to enforce the signaling MTU for BR/EDR packets. A peer device can send an oversized 681‑byte packet containing many L2CAP_ECHO_REQ commands, which the kernel accepts and processes, resulting in the kernel generating 168 L2CAP_ECHO_RSP frames in under 220 ms. This forced transmission of many frames can exhaust the device’s radio resources and saturate its traffic handling, effectively causing a denial of service for the affected host.

Affected Systems

The flaw resides in the generic Linux kernel, specifically in net/bluetooth/l2cap_core.c. It impacts all kernel versions that include the unpatched BR/EDR signaling parser, including those represented by the CPE strings 2.6.12, 7.1, and generic Linux kernel releases. No specific vendor or product beyond the kernel itself is listed, and the vulnerability applies to any host that runs Bluetooth before pairing with a BR/EDR peer.

Risk and Exploitability

The CVSS score of 5.5 classifies the issue as medium severity, while the EPSS score of less than 1 % shows that exploitation is currently unlikely but not impossible. The exploit requires a Bluetooth BR/EDR device to be within radio range of the target, and the attacker only needs to send a single oversized packet, making the attack relatively simple when proximity is satisfied. The vulnerability is not listed in the CISA KEV, and no public exploits have been documented, placing the overall risk at moderate to high for deployments that keep Bluetooth enabled and leave the kernel unpatched.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< e05c4ac575b457978a7ef441053394169084869c
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< fa5823126239b3e453fac1a2fe50726c7f4a55e1
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< b20e8a98dd29b121f58fcdf51e8576119aba536a
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 214a2042b16b3c8d798a8b9ef9f36094f13a9859
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< a8335f3db15bd1e0e82e0db5d488fabc7d10d1ab
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< dedc92b96dc1d8919a3bdf2495ede68922ef7ebc
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< e2b8acf9405bd9b1baf1c54dc897b0905db689bf
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< dd214733544427587a95f66dbf3adff072568990

Linux

affected

Version	Status	Constraints
`2.6.12`	affected	—
`0`	unaffected	< 2.6.12
`5.10.259`	unaffected	≤ 5.10.*
`5.15.210`	unaffected	≤ 5.15.*
`6.1.176`	unaffected	≤ 6.1.*
`6.6.143`	unaffected	≤ 6.6.*
`6.12.94`	unaffected	≤ 6.12.*
`6.18.36`	unaffected	≤ 6.18.*
`7.0.13`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:2.6.12:-::::::
	cpe:2.3:o:linux:linux_kernel:2.6.12:rc2::::::
	cpe:2.3:o:linux:linux_kernel:2.6.12:rc3::::::
	cpe:2.3:o:linux:linux_kernel:2.6.12:rc4::::::
	cpe:2.3:o:linux:linux_kernel:2.6.12:rc5::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc1::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc2::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc3::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc4::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc5::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc6::::::

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,e05c4ac575b457978a7ef441053394169084869c)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,fa5823126239b3e453fac1a2fe50726c7f4a55e1)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,b20e8a98dd29b121f58fcdf51e8576119aba536a)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,214a2042b16b3c8d798a8b9ef9f36094f13a9859)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,a8335f3db15bd1e0e82e0db5d488fabc7d10d1ab)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,dedc92b96dc1d8919a3bdf2495ede68922ef7ebc)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,e2b8acf9405bd9b1baf1c54dc897b0905db689bf)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,dd214733544427587a95f66dbf3adff072568990)`	affected	code_commit	—
`[0,5.10.259)`	affected	semver	—
`[0,5.15.210)`	affected	semver	—
`[0,6.1.176)`	affected	semver	—
`[0,6.6.143)`	affected	semver	—
`[0,6.12.94)`	affected	semver	—
`[0,6.18.36)`	affected	semver	—
`[0,7.0.13)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[5.10.259,6.0.0)`	unaffected	semver	—
`[5.15.210,6.0.0)`	unaffected	semver	—
`[6.1.176,7.0.0)`	unaffected	semver	—
`[6.6.143,7.0.0)`	unaffected	semver	—
`[6.12.94,7.0.0)`	unaffected	semver	—
`[6.18.36,7.0.0)`	unaffected	semver	—
`[7.0.13,8.0.0)`	unaffected	semver	—
`[7.1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that includes the L2CAP signaling MTU enforcement fix
Disable Bluetooth or block BR/EDR traffic on the affected systems using firewall or policy rules
Monitor Bluetooth traffic for oversized signaling packets and drop them at the network layer if the kernel cannot be patched

Generated by OpenCVE AI on August 13, 2026 at 13:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4664-1	linux security update
Debian DLA	DLA-4665-1	linux security update
Debian DLA	DLA-4671-1	linux-6.1 security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00123.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/214a2042b16b3c8d798a8b9ef9f36094f13a9859
https://git.kernel.org/stable/c/a8335f3db15bd1e0e82e0db5d488fabc7d10d1ab
https://git.kernel.org/stable/c/b20e8a98dd29b121f58fcdf51e8576119aba536a
https://git.kernel.org/stable/c/dd214733544427587a95f66dbf3adff072568990
https://git.kernel.org/stable/c/dedc92b96dc1d8919a3bdf2495ede68922ef7ebc
https://git.kernel.org/stable/c/e05c4ac575b457978a7ef441053394169084869c
https://git.kernel.org/stable/c/e2b8acf9405bd9b1baf1c54dc897b0905db689bf
https://git.kernel.org/stable/c/fa5823126239b3e453fac1a2fe50726c7f4a55e1
https://lore.kernel.org/linux-cve-announce/2026062502-CVE-2026-53208-0404@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-53208
https://www.cve.org/CVERecord?id=CVE-2026-53208

History

Fri, 26 Jun 2026 14:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-20 CWE-400

Fri, 26 Jun 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-1284
References		https://lore.kernel.org/linux-cve-announce/2026062502-CVE-2026-53208-0404@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-53208 https://www.cve.org/CVERecord?id=CVE-2026-53208
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Moderate`

Thu, 25 Jun 2026 11:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-20 CWE-400

Thu, 25 Jun 2026 09:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig net/bluetooth/l2cap_core.c:l2cap_sig_channel() accepts BR/EDR signaling packets up to the channel MTU and dispatches each command without enforcing the signaling MTU (MTUsig). A Bluetooth BR/EDR peer within radio range can send a fixed-channel CID 0x0001 packet that is larger than MTUsig and contains many L2CAP_ECHO_REQ commands before pairing. In a real-radio stock-kernel run, one 681-byte signaling packet containing 168 zero-length ECHO_REQ commands made the target transmit 168 ECHO_RSP frames over about 220 ms. Impact: a Bluetooth BR/EDR peer within radio range, before pairing, can force 168 ECHO_RSP frames from one 681-byte fixed-channel signaling packet containing packed ECHO_REQ commands. Define Linux's BR/EDR signaling MTU as the spec minimum of 48 bytes and reject any larger signaling packet with one L2CAP_COMMAND_REJECT_RSP carrying L2CAP_REJ_MTU_EXCEEDED before any command is dispatched. The Bluetooth Core spec wording for MTUExceeded says the reject identifier shall match the first request command in the packet, and that packets containing only responses shall be silently discarded. Linux intentionally deviates from that prescription: silently discarding desynchronizes the peer because the remote stack never learns its responses were dropped, and locating the first request command requires walking command headers past MTUsig, i.e. processing bytes from a packet we have already decided is too large to process. We therefore always emit one reject and use the identifier from the first command header, a single fixed-offset byte read. The unrestricted BR/EDR signaling parser and ECHO_REQ response path both trace to the initial git import; no later introducing commit is available for a Fixes tag.
Title		Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/214a2042b16b3c8d798a8b9ef9f36094f13a9859 https://git.kernel.org/stable/c/a8335f3db15bd1e0e82e0db5d488fabc7d10d1ab https://git.kernel.org/stable/c/b20e8a98dd29b121f58fcdf51e8576119aba536a https://git.kernel.org/stable/c/dd214733544427587a95f66dbf3adff072568990 https://git.kernel.org/stable/c/dedc92b96dc1d8919a3bdf2495ede68922ef7ebc https://git.kernel.org/stable/c/e05c4ac575b457978a7ef441053394169084869c https://git.kernel.org/stable/c/e2b8acf9405bd9b1baf1c54dc897b0905db689bf https://git.kernel.org/stable/c/fa5823126239b3e453fac1a2fe50726c7f4a55e1

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-06-25T08:39:14.257Z

Updated: 2026-06-29T04:18:57.916Z

Reserved: 2026-06-09T07:44:35.391Z

Link: CVE-2026-53208

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2026-06-25T09:16:38.350

Modified: 2026-07-02T20:55:04.500

Link: CVE-2026-53208

Redhat

Severity : Moderate

Publid Date: 2026-06-25T00:00:00Z

Links: CVE-2026-53208 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-13T13:30:17Z

Weaknesses

CWE-1284
Improper Validation of Specified Quantity in Input
NVD-CWE-noinfo

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object