NetSight
IP …
high8.1

CVE-2026-53254

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: validate skb length in MCC handlers The RFCOMM MCC handlers cast skb->da…

Impact

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: validate skb length in MCC handlers The RFCOMM MCC handlers cast skb->data to protocol-specific structs without validating skb->len first. A malicious remote device can send truncated MCC frames and trigger out-of-bounds reads in these handlers. Fix this by using skb_pull_data() to validate and access the required data before dereferencing it. rfcomm_recv_rpn() requires special handling since ETSI TS 07.10 allows 1-byte RPN requests. Handle this by validating only the DLCI byte first, and validating the full struct only when len > 1.

Affected products

VendorProductAffected versions
LinuxLinux Kernel
from 2.6.12.1 before 5.15.210
from 5.16 before 6.1.176
from 6.2 before 6.6.143
from 6.7 before 6.12.94
from 6.13 before 6.18.36
from 6.19 before 7.0.13

Weakness classification

CWE-125

References