CVE-2026-53254: Bluetooth: RFCOMM: validate skb length in MCC handlers

Affected Software

Remediation

Recommended actions to resolve this vulnerability, in priority order.

1. Upgrade

   Upgrade to a fixed release to a version that resolves this vulnerability.

   Fixed in 6.6.143.1-1
2. Configuration

   In the RFCOMM MCC handlers, use skb_pull_data() to validate and access required data before casting skb->data to protocol-specific structs; ensure full struct validation is gated so it only occurs when skb->len indicates sufficient length (and validate only the DLCI byte first).

   Linux kernel RFCOMM (MCC handlers) skb length validation before dereferencing protocol-specific structs = validate skb length using skb_pull_data()
3. Configuration

   In rfcomm_recv_rpn(), add special handling for ETSI TS 07.10 truncated MCC frames by validating skb->len before dereferencing fields to prevent out-of-bounds reads.

   Linux kernel rfcomm_recv_rpn() MCC frame length validation = validate skb->len before accessing fields / special handling for truncated frames

Event History

Frequently Asked Questions