CVE-2026-98602 - Vulnerability Details

- Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough

Fix multiple out-of-bounds reads in Bluetooth BNEP frame processing:

1. In bnep_rx_frame() and bnep_ctrl_frame() (net/bluetooth/bnep/core.c),
use pskb_may_pull() to verify the BNEP header, control type byte,
filter count, and extension headers exist before reading them, and
return 0 after handling BNEP_CONTROL instead of falling through to
Ethernet frame submission when no extension headers follow.
2. In bnep_net_xmit() (net/bluetooth/bnep/netdev.c), verify skb->len >=
ETH_HLEN with pskb_may_pull() before reading the 14-byte Ethernet
header to prevent an out-of-bounds heap read and infoleak on short
AF_PACKET TX frames.

Published: 2026-10-18

Score: 6.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel includes a bug in the Bluetooth BNEP subsystem, where short receive and transmit frames can trigger out‑of‑bounds reads when processing BNEP headers, control types, and extension headers. This unchecked read flaw, classified as CWE‑125, can expose contents of kernel memory beyond the intended buffer, potentially leaking sensitive data.

Affected Systems

The defect affects all Linux kernel versions that include the BNEP subsystem. No specific version range is listed in the advisories, so any kernel running in an environment with Bluetooth BNEP enabled could be vulnerable until patched.

Risk and Exploitability

Because the flaw involves out‑of‑bounds reads in the Bluetooth BNEP frame handling routines, it is inferred that an attacker with local access who can inject crafted frames via the Bluetooth interface could read memory beyond allocated buffers, potentially leaking kernel or user data. The CVSS score of 6.5 typifies a medium severity vulnerability that could lead to information disclosure. The EPSS score of <1% and the fact that the issue is not yet listed in CISA’s KEV catalog suggest that active exploitation has not been observed. Because the capability to inject packets depends on local Bluetooth access, it is inferred that the attack vector is local, which means systems running BNEP with exposed interfaces remain at risk.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 7af80ad2cebfe2f1879d6a39a1aaa061d9c4e1ca
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 667aa703e11cdc237d169393bc6a5ea9acbb33c2
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 3e605ff5932afe0970c2beca66f2f1ba2babe4dd
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 035f9b1809861967e58ce652680d70ea1502058f
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 1e7aebc188f889b56c3aaeb6133ef6d77022c887
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 8f31031326994d1abfcc6ebb6927ef96e51fb9ff
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< ad0d2d4ada51321db787262ef343193c712b76b5
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< f0ca020cbb9bb7f3f4ea8ba1dfcf30a282aec91e

Linux

affected

Version	Status	Constraints
`2.6.12`	affected	—
`0`	unaffected	< 2.6.12
`5.10.271`	unaffected	≤ 5.10.*
`5.15.222`	unaffected	≤ 5.15.*
`6.1.189`	unaffected	≤ 6.1.*
`6.6.158`	unaffected	≤ 6.6.*
`6.12.112`	unaffected	≤ 6.12.*
`6.18.55`	unaffected	≤ 6.18.*
`7.2.9`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,7af80ad2cebfe2f1879d6a39a1aaa061d9c4e1ca)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,667aa703e11cdc237d169393bc6a5ea9acbb33c2)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,3e605ff5932afe0970c2beca66f2f1ba2babe4dd)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,035f9b1809861967e58ce652680d70ea1502058f)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,1e7aebc188f889b56c3aaeb6133ef6d77022c887)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,8f31031326994d1abfcc6ebb6927ef96e51fb9ff)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,ad0d2d4ada51321db787262ef343193c712b76b5)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,f0ca020cbb9bb7f3f4ea8ba1dfcf30a282aec91e)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`2.6.12`	affected	semver	—
`[0,2.6.12)`	unaffected	generic	—
`[5.10.271,5.11.0)`	unaffected	semver	—
`[5.15.222,5.16.0)`	unaffected	semver	—
`[6.1.189,6.2.0)`	unaffected	semver	—
`[6.6.158,6.7.0)`	unaffected	semver	—
`[6.12.112,6.13.0)`	unaffected	semver	—
`[6.18.55,6.19.0)`	unaffected	semver	—
`[7.2.9,7.3.0)`	unaffected	semver	—
`[7.3-rc5,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the kernel to the latest version that includes the bound checks for BNEP frame processing.
Disable or restrict Bluetooth BNEP functionality on systems that do not require it.
Configure the system firewall or security controls to block unsolicited Bluetooth traffic, reducing the attack surface.

Generated by OpenCVE AI on October 23, 2026 at 07:01 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4850-1	linux-6.12 security update
Ubuntu USN	USN-8961-1	Linux kernel vulnerabilities

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00216.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98602.mbox
https://git.kernel.org/stable/c/035f9b1809861967e58ce652680d70ea1502058f
https://git.kernel.org/stable/c/1e7aebc188f889b56c3aaeb6133ef6d77022c887
https://git.kernel.org/stable/c/3e605ff5932afe0970c2beca66f2f1ba2babe4dd
https://git.kernel.org/stable/c/667aa703e11cdc237d169393bc6a5ea9acbb33c2
https://git.kernel.org/stable/c/7af80ad2cebfe2f1879d6a39a1aaa061d9c4e1ca
https://git.kernel.org/stable/c/8f31031326994d1abfcc6ebb6927ef96e51fb9ff
https://git.kernel.org/stable/c/ad0d2d4ada51321db787262ef343193c712b76b5
https://git.kernel.org/stable/c/f0ca020cbb9bb7f3f4ea8ba1dfcf30a282aec91e
https://nvd.nist.gov/vuln/detail/CVE-2026-98602
https://www.cve.org/CVERecord?id=CVE-2026-98602

History

Fri, 23 Oct 2026 00:45:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-200 CWE-788

Wed, 21 Oct 2026 00:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-125
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98602.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-98602 https://www.cve.org/CVERecord?id=CVE-2026-98602
Metrics	threat_severity `None`	cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Sun, 18 Oct 2026 19:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-200 CWE-788

Sun, 18 Oct 2026 15:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough Fix multiple out-of-bounds reads in Bluetooth BNEP frame processing: 1. In bnep_rx_frame() and bnep_ctrl_frame() (net/bluetooth/bnep/core.c), use pskb_may_pull() to verify the BNEP header, control type byte, filter count, and extension headers exist before reading them, and return 0 after handling BNEP_CONTROL instead of falling through to Ethernet frame submission when no extension headers follow. 2. In bnep_net_xmit() (net/bluetooth/bnep/netdev.c), verify skb->len >= ETH_HLEN with pskb_may_pull() before reading the 14-byte Ethernet header to prevent an out-of-bounds heap read and infoleak on short AF_PACKET TX frames.
Title		Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/035f9b1809861967e58ce652680d70ea1502058f https://git.kernel.org/stable/c/1e7aebc188f889b56c3aaeb6133ef6d77022c887 https://git.kernel.org/stable/c/3e605ff5932afe0970c2beca66f2f1ba2babe4dd https://git.kernel.org/stable/c/667aa703e11cdc237d169393bc6a5ea9acbb33c2 https://git.kernel.org/stable/c/7af80ad2cebfe2f1879d6a39a1aaa061d9c4e1ca https://git.kernel.org/stable/c/8f31031326994d1abfcc6ebb6927ef96e51fb9ff https://git.kernel.org/stable/c/ad0d2d4ada51321db787262ef343193c712b76b5 https://git.kernel.org/stable/c/f0ca020cbb9bb7f3f4ea8ba1dfcf30a282aec91e

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-18T15:19:14.606Z

Updated: 2026-10-19T09:22:29.455Z

Reserved: 2026-09-25T10:25:14.359Z

Link: CVE-2026-98602

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-18T16:17:12.920

Modified: 2026-10-19T10:19:21.857

Link: CVE-2026-98602

Redhat

Severity : Moderate

Publid Date: 2026-10-18T00:00:00Z

Links: CVE-2026-98602 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-23T07:15:17Z

Weaknesses

CWE-125
Out-of-bounds Read

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object