CVE-2026-98600

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame()

While rfcomm_recv_frame() verifies that skb->len is at least

sizeof(*hdr) + 1 (4 bytes: 3-byte header + 1-byte FCS), an RFCOMM frame

with an extended 2-byte length field (!__test_ea(hdr->len)) has a 4-byte

header plus a 1-byte FCS (5 bytes minimum, sizeof(*hdr) + 2).

When a 4-byte RFCOMM frame with EA == 0 arrives:

1. The initial skb->len < sizeof(*hdr) + 1 check passes (4 < 4 is false).

2. Trimming the FCS byte decrements skb->len to 3.

3. If __check_fcs() succeeds, skb_pull(skb, 4) fails (4 > 3) and returns

NULL without advancing skb->data.

4. Because the return value of skb_pull() is ignored, the un-pulled

3-byte struct rfcomm_hdr remains at skb->data and is either queued as

application payload via rfcomm_recv_data() or parsed as a multiplexer

control command via rfcomm_recv_mcc() on DLCI 0.

Fix this by extending the length check in r

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References