A flaw in the Linux kernel's RFCOMM implementation fails to correctly validate the length of frames that use an extended two‑byte length field with EA==0. The kernel checks that the packet length is at least the size of the header plus one byte, but it does not enforce the additional byte required when EA is set to zero. As a result, a malformed 4‑byte frame can slip through the initial test. The subsequent processing trims the Frame Check Sequence byte, reducing the length to three bytes, and then attempts to pull four bytes from the buffer. Because the pull fails but its return value is ignored, the three‑byte frame header remains unprocessed in the socket buffer. If the checksum verification succeeds, the kernel may forward this incomplete header to user space either as payload data or as a multiplexer control command. This mishandling can lead to incorrect application behavior or, in the worst case, a kernel crash, effectively allowing a remote attacker to cause a denial of service through crafted Bluetooth packets.

All Linux kernels that expose a Bluetooth RFCOMM interface are potentially vulnerable. Consumers of the kernel through any distribution that has not applied the patch for the described RFCOMM frame validation issue are at risk. The vulnerability affects the core kernel code that processes incoming RFCOMM frames, so any system running a kernel configuration with Bluetooth support may be impacted.

The vulnerability can be exercised by an attacker who can send a specially crafted short RFCOMM frame to the target system, which is typically achieved over an active Bluetooth connection. The attack vector is remote, requiring only Bluetooth proximity. Although the EPSS score is unavailable and the issue is not listed in the CISA KEV catalog, the potential for a denial of service and the non‑negligible likelihood of exploitation through a Bluetooth interface suggest a moderate risk. The lack of a publishable exploit in the public domain does not eliminate the possibility that attackers could trigger the flaw, especially given the simplicity of the packet manipulation required.