CVE-2026-90088

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop

rfcomm_apply_pn() accepts the MTU value from a remote PN (Parameter

Negotiation) frame without checking for zero. When the remote peer

sends an MTU of zero, d->mtu is set to 0. This causes the sendmsg

path to enter an infinite loop when fragmenting data, as each fragment

has size == min_t(size_t, len, 0) == 0, so the remaining length never

decreases. The infinite allocation of zero-length skbs exhausts all

system memory.

Fix by clamping d->mtu to RFCOMM_DEFAULT_MTU when the negotiated

value is zero, consistent with the initial value assigned in

rfcomm_dlc_alloc().

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References