CVE-2026-53253 - Vulnerability Details

- Bluetooth: bnep: reject short frames before parsing

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: bnep: reject short frames before parsing

A BNEP peer can send a short BNEP SDU. bnep_rx_frame() reads the
packet type byte immediately and, for control packets, reads the control
opcode and setup UUID-size byte before proving that those bytes are
present. bnep_rx_control() also dereferences the control opcode without
rejecting an empty control payload.

Use skb_pull_data() for the fixed fields in bnep_rx_frame() so a NULL
return gates each dereference. Split the control handler so the frame
path can pass an opcode that has already been pulled, and keep the
byte-buffer wrapper for extension control payloads.

For BNEP_SETUP_CONN_REQ, name the UUID-size byte before pulling the
setup payload. struct bnep_setup_conn_req carries destination and source
service UUIDs after that byte, each uuid_size bytes, so the parser now
documents that tuple explicitly instead of leaving the pull length as an
opaque multiplication.

Validation reproduced this kernel report:
KASAN slab-out-of-bounds in bnep_rx_frame.isra.0+0x130c/0x1790
The buggy address belongs to the object at ffff88800c0f7908 which belongs
to the cache kmalloc-8 of size 8
The buggy address is located 0 bytes to the right of allocated 1-byte
region [ffff88800c0f7908, ffff88800c0f7909)
Read of size 1
Call trace:
dump_stack_lvl+0xb3/0x140 (?:?)
print_address_description+0x57/0x3a0 (?:?)
bnep_rx_frame+0x130c/0x1790 (net/bluetooth/bnep/core.c:306)
print_report+0xb9/0x2b0 (?:?)
__virt_addr_valid+0x1ba/0x3a0 (?:?)
srso_alias_return_thunk+0x5/0xfbef5 (?:?)
kasan_addr_to_slab+0x21/0x60 (?:?)
kasan_report+0xe0/0x110 (?:?)
process_one_work+0xfce/0x17e0 (kernel/workqueue.c:3200)
worker_thread+0x65c/0xe40 (?:?)
__kthread_parkme+0x184/0x230 (?:?)
kthread+0x35e/0x470 (?:?)
_raw_spin_unlock_irq+0x28/0x50 (?:?)
ret_from_fork+0x586/0x870 (?:?)
__switch_to+0x74f/0xdc0 (?:?)
ret_from_fork_asm+0x1a/0x30 (?:?)

Published: 2026-06-25

Score: 7.1 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A vulnerable Linux kernel allows a Bluetooth Network Encapsulation Protocol peer to send a truncated BNEP service data unit. The kernel incorrectly assumes that control packet fields are present and dereferences bytes that do not exist, leading to an out‑of‑bounds read. This memory corruption can crash the kernel.

Affected Systems

All Linux systems running kernel versions that have not been patched to include the BNEP short‑frame rejection logic. The affected binary is the Linux kernel, specifically the Bluetooth BNEP module; vendor is Linux and product is the Linux kernel. No specific version information is supplied in the advisory, so any kernel prior to at risk.

Risk and Exploitability

Based on the description, it is inferred that the likely attack vector is an attacker establishing a Bluetooth connection to the vulnerable host and sending a crafted short frame. The CVSS score of 7.1 indicates a high severity classification. Because the flaw occurs in kernel space, it is inferred that successful exploitation could lead to a denial of service. The EPSS score of <1% indicates a very low but non‑zero exploitation probability. The vulnerability is not listed in the CISA KEV catalog, so no known publicly exploited incidents are documented.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 0ef2ea86c82b2615902d085cd5a586fe9f58994f
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 2b83afb19293e4de700edae306115f18966dc4f9
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 691f14b6a48b637655755134f1e551c7c6fedc2e
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< d76dec1a37122bc16d83d059c08c0512ea8de909
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< c893e17d2809ec9c4b3f1cdd5847cecbc27a311b
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< be837cd09897e9e6e1958174501d467bdcbcc2bc
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 6770d3a8acdf9151769180cc3710346c4cfbe6f0

Linux

affected

Version	Status	Constraints
`2.6.12`	affected	—
`0`	unaffected	< 2.6.12
`5.15.210`	unaffected	≤ 5.15.*
`6.1.176`	unaffected	≤ 6.1.*
`6.6.143`	unaffected	≤ 6.6.*
`6.12.94`	unaffected	≤ 6.12.*
`6.18.36`	unaffected	≤ 6.18.*
`7.0.13`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,0ef2ea86c82b2615902d085cd5a586fe9f58994f)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,2b83afb19293e4de700edae306115f18966dc4f9)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,691f14b6a48b637655755134f1e551c7c6fedc2e)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a8a0c1fc7321cac2,d76dec1a37122bc16d83d059c08c0512ea8de909)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,c893e17d2809ec9c4b3f1cdd5847cecbc27a311b)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,be837cd09897e9e6e1958174501d467bdcbcc2bc)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,6770d3a8acdf9151769180cc3710346c4cfbe6f0)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`2.6.12`	affected	semver	—
`[0,2.6.12)`	unaffected	semver	—
`[5.15.210,5.15.*]`	unaffected	generic	—
`[6.1.176,6.1.*]`	unaffected	generic	—
`[6.6.143,6.6.*]`	unaffected	generic	—
`[6.12.94,6.12.*]`	unaffected	generic	—
`[6.18.36,6.18.*]`	unaffected	generic	—
`[7.0.13,7.0.*]`	unaffected	generic	—
`[7.1, *]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the Linux kernel to a version that includes the BNEP short‑frame rejection patch
Disable the Bluetooth interface or BNEP module on systems that do not require Bluetooth connections with a firewall or by blocking the adapter with rfkill
Configure the system to reject or restrict Bluetooth connections, e.g., using rfkill to block the adapter or disabling the bnep service, to reduce exposure while a patch is pending.

Generated by OpenCVE AI on June 28, 2026 at 15:07 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4665-1	linux security update
Debian DLA	DLA-4671-1	linux-6.1 security update

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00274.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/0ef2ea86c82b2615902d085cd5a586fe9f58994f
https://git.kernel.org/stable/c/2b83afb19293e4de700edae306115f18966dc4f9
https://git.kernel.org/stable/c/6770d3a8acdf9151769180cc3710346c4cfbe6f0
https://git.kernel.org/stable/c/691f14b6a48b637655755134f1e551c7c6fedc2e
https://git.kernel.org/stable/c/be837cd09897e9e6e1958174501d467bdcbcc2bc
https://git.kernel.org/stable/c/c893e17d2809ec9c4b3f1cdd5847cecbc27a311b
https://git.kernel.org/stable/c/d76dec1a37122bc16d83d059c08c0512ea8de909
https://lore.kernel.org/linux-cve-announce/2026062514-CVE-2026-53253-868d@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-53253
https://www.cve.org/CVERecord?id=CVE-2026-53253

History

Tue, 30 Jun 2026 00:45:00 +0000

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2026062514-CVE-2026-53253-868d@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-53253 https://www.cve.org/CVERecord?id=CVE-2026-53253
Metrics	threat_severity `None`	threat_severity `Moderate`

Sun, 28 Jun 2026 15:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-20

Sun, 28 Jun 2026 13:45:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-788

Sun, 28 Jun 2026 08:00:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.1, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H'}`

Thu, 25 Jun 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-788

Thu, 25 Jun 2026 09:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bnep: reject short frames before parsing A BNEP peer can send a short BNEP SDU. bnep_rx_frame() reads the packet type byte immediately and, for control packets, reads the control opcode and setup UUID-size byte before proving that those bytes are present. bnep_rx_control() also dereferences the control opcode without rejecting an empty control payload. Use skb_pull_data() for the fixed fields in bnep_rx_frame() so a NULL return gates each dereference. Split the control handler so the frame path can pass an opcode that has already been pulled, and keep the byte-buffer wrapper for extension control payloads. For BNEP_SETUP_CONN_REQ, name the UUID-size byte before pulling the setup payload. struct bnep_setup_conn_req carries destination and source service UUIDs after that byte, each uuid_size bytes, so the parser now documents that tuple explicitly instead of leaving the pull length as an opaque multiplication. Validation reproduced this kernel report: KASAN slab-out-of-bounds in bnep_rx_frame.isra.0+0x130c/0x1790 The buggy address belongs to the object at ffff88800c0f7908 which belongs to the cache kmalloc-8 of size 8 The buggy address is located 0 bytes to the right of allocated 1-byte region [ffff88800c0f7908, ffff88800c0f7909) Read of size 1 Call trace: dump_stack_lvl+0xb3/0x140 (?:?) print_address_description+0x57/0x3a0 (?:?) bnep_rx_frame+0x130c/0x1790 (net/bluetooth/bnep/core.c:306) print_report+0xb9/0x2b0 (?:?) __virt_addr_valid+0x1ba/0x3a0 (?:?) srso_alias_return_thunk+0x5/0xfbef5 (?:?) kasan_addr_to_slab+0x21/0x60 (?:?) kasan_report+0xe0/0x110 (?:?) process_one_work+0xfce/0x17e0 (kernel/workqueue.c:3200) worker_thread+0x65c/0xe40 (?:?) __kthread_parkme+0x184/0x230 (?:?) kthread+0x35e/0x470 (?:?) _raw_spin_unlock_irq+0x28/0x50 (?:?) ret_from_fork+0x586/0x870 (?:?) __switch_to+0x74f/0xdc0 (?:?) ret_from_fork_asm+0x1a/0x30 (?:?)
Title		Bluetooth: bnep: reject short frames before parsing
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0ef2ea86c82b2615902d085cd5a586fe9f58994f https://git.kernel.org/stable/c/2b83afb19293e4de700edae306115f18966dc4f9 https://git.kernel.org/stable/c/6770d3a8acdf9151769180cc3710346c4cfbe6f0 https://git.kernel.org/stable/c/691f14b6a48b637655755134f1e551c7c6fedc2e https://git.kernel.org/stable/c/be837cd09897e9e6e1958174501d467bdcbcc2bc https://git.kernel.org/stable/c/c893e17d2809ec9c4b3f1cdd5847cecbc27a311b https://git.kernel.org/stable/c/d76dec1a37122bc16d83d059c08c0512ea8de909

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-06-25T08:39:44.612Z

Updated: 2026-06-28T06:40:57.768Z

Reserved: 2026-06-09T07:44:35.394Z

Link: CVE-2026-53253

Vulnrichment

No data.

NVD

No data.

Redhat

Severity : Moderate

Publid Date: 2026-06-25T00:00:00Z

Links: CVE-2026-53253 - Bugzilla

OpenCVE Enrichment

Updated: 2026-06-28T15:15:05Z

Weaknesses

CWE-20
Improper Input Validation

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object