CVE-2026-98107 - Vulnerability Details

- Bluetooth: L2CAP: fix out-of-bounds write in l2cap_ecred_connect

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: L2CAP: fix out-of-bounds write in l2cap_ecred_connect

l2cap_chan_connect() tries to ensure there are no more than
L2CAP_ECRED_CONN_SCID_MAX pending ECRED channels, so they fit in the
same L2CAP_ECRED_CONN_REQ that l2cap_ecred_connect() constructs.

However, the check only counts deferred channels. If 6 L2CAP sockets
are connected at the same time in order DDDDND (D=deferred,
N=non-deferred), the last can bump the total to max+1. It results to
one __le16 written out of bounds of the scid array, and an invalid
ECRED_CONN_REQ being sent.

Fix by leaving room for the non-deferred pending ECRED channels in the
counting in l2cap_chan_connect(), so the limit can't be exceeded.

Move counting under same critical section where the channel is added.
Although race conditions involving this appear unreachable, it's easier
to see.

Also add WARN_ON_ONCE check in l2cap_ecred_defer_connect() to make this
less brittle.

Published: 2026-09-25

Score: n/a

EPSS: n/a

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel’s Bluetooth L2CAP module contains an out‑of‑bounds write in the ecred connect routine. When several L2CAP sockets connect simultaneously, the code miscounts deferred channels and writes a 16‑bit value past the end of a SCID array. This overflow corrupts kernel memory and results in a malformed ECRED_CONN_REQ being sent. The weakness matches CWE‑788.

Affected Systems

All Linux kernels that include the legacy Bluetooth L2CAP subsystem and have not incorporated the fixes in commits 56c2b5831d39dc84aad2573dc3e197af1a872a05, 6da5c0331fc3ef0c7b8df8269523fc3b2cce1e65, ce0927eb3ee2939fab5ce3f9334bfd2fafb38481, or df8c3af6132640da4788e96a02d653e642059803 are vulnerable. Users of distributions shipping kernels prior to the inclusion of these commits—and that have L2CAP enabled on an active Bluetooth interface—are at risk.

Risk and Exploitability

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, so no known active exploits exist at this time. The likely attack vector is remote: a malicious Bluetooth device may initiate a carefully crafted L2CAP connection to trigger the overflow. The potential impact is not fully detailed but could affect system stability or the operation of the Bluetooth subsystem. Prompt patching removes the flaw and restores normal kernel behavior.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`da49b602f7f75ccc91386e1274b3ef71676cd092`	affected	< ce0927eb3ee2939fab5ce3f9334bfd2fafb38481
`da49b602f7f75ccc91386e1274b3ef71676cd092`	affected	< 6da5c0331fc3ef0c7b8df8269523fc3b2cce1e65
`da49b602f7f75ccc91386e1274b3ef71676cd092`	affected	< df8c3af6132640da4788e96a02d653e642059803
`da49b602f7f75ccc91386e1274b3ef71676cd092`	affected	< 56c2b5831d39dc84aad2573dc3e197af1a872a05

Linux

affected

Version	Status	Constraints
`5.7`	affected	—
`0`	unaffected	< 5.7
`6.12.111`	unaffected	≤ 6.12.*
`6.18.53`	unaffected	≤ 6.18.*
`7.2.7`	unaffected	≤ 7.2.*
`7.3-rc2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[da49b602f7f75ccc91386e1274b3ef71676cd092,ce0927eb3ee2939fab5ce3f9334bfd2fafb38481)`	affected	code_commit	—
`[da49b602f7f75ccc91386e1274b3ef71676cd092,6da5c0331fc3ef0c7b8df8269523fc3b2cce1e65)`	affected	code_commit	—
`[da49b602f7f75ccc91386e1274b3ef71676cd092,df8c3af6132640da4788e96a02d653e642059803)`	affected	code_commit	—
`[da49b602f7f75ccc91386e1274b3ef71676cd092,56c2b5831d39dc84aad2573dc3e197af1a872a05)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.7`	affected	generic	—
`[0,5.7)`	unaffected	generic	—
`[6.12.111,6.13.0)`	unaffected	semver	—
`[6.18.53,6.19.0)`	unaffected	semver	—
`[7.2.7,7.3.0)`	unaffected	semver	—
`[7.3-rc2,*]`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the kernel patch that incorporates commits 56c2b5831d39dc84aad2573dc3e197af1a872a05, 6da5c0331fc3ef0c7b8df8269523fc3b2cce1e65, ce0927eb3ee2939fab5ce3f9334bfd2fafb38481, and df8c3af6132640da4788e96a02d653e642059803 to fix the out‑of‑bounds write.
If the latest kernel cannot be applied immediately, unload or disable the Bluetooth L2CAP kernel module to prevent vulnerable code from executing.
Configure host firewall or Bluetooth access controls to block or restrict L2CAP traffic from unknown or untrusted devices.
Limit the Bluetooth adapter to trusted devices using host‑side ACLs or bonding to further reduce exposure.

Generated by OpenCVE AI on September 25, 2026 at 13:49 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/56c2b5831d39dc84aad2573dc3e197af1a872a05
https://git.kernel.org/stable/c/6da5c0331fc3ef0c7b8df8269523fc3b2cce1e65
https://git.kernel.org/stable/c/ce0927eb3ee2939fab5ce3f9334bfd2fafb38481
https://git.kernel.org/stable/c/df8c3af6132640da4788e96a02d653e642059803

History

Fri, 25 Sep 2026 14:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-788

Fri, 25 Sep 2026 10:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix out-of-bounds write in l2cap_ecred_connect l2cap_chan_connect() tries to ensure there are no more than L2CAP_ECRED_CONN_SCID_MAX pending ECRED channels, so they fit in the same L2CAP_ECRED_CONN_REQ that l2cap_ecred_connect() constructs. However, the check only counts deferred channels. If 6 L2CAP sockets are connected at the same time in order DDDDND (D=deferred, N=non-deferred), the last can bump the total to max+1. It results to one __le16 written out of bounds of the scid array, and an invalid ECRED_CONN_REQ being sent. Fix by leaving room for the non-deferred pending ECRED channels in the counting in l2cap_chan_connect(), so the limit can't be exceeded. Move counting under same critical section where the channel is added. Although race conditions involving this appear unreachable, it's easier to see. Also add WARN_ON_ONCE check in l2cap_ecred_defer_connect() to make this less brittle.
Title		Bluetooth: L2CAP: fix out-of-bounds write in l2cap_ecred_connect
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/56c2b5831d39dc84aad2573dc3e197af1a872a05 https://git.kernel.org/stable/c/6da5c0331fc3ef0c7b8df8269523fc3b2cce1e65 https://git.kernel.org/stable/c/ce0927eb3ee2939fab5ce3f9334bfd2fafb38481 https://git.kernel.org/stable/c/df8c3af6132640da4788e96a02d653e642059803

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-25T10:35:56.340Z

Updated: 2026-09-25T10:35:56.340Z

Reserved: 2026-09-25T10:25:14.316Z

Link: CVE-2026-98107

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-25T11:17:41.743

Modified: 2026-09-25T11:17:41.743

Link: CVE-2026-98107

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-09-25T14:00:13Z

Weaknesses

CWE-788
Access of Memory Location After End of Buffer

Impact

Affected Systems

Risk and Exploitability

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object