CVE-2026-93783: Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: RFCOMM: validate skb length in rfcommrecvframe
rfcommrecvframe() casts skb->data to struct rfcommhdr and dereferences hdr->addr and hdr->ctrl without validating skb->len first. A truncated frame with skb->len less than the minimum header size causes an out-of-bounds read of uninitialized memory. Additionally, a zero-length frame causes skb->len-- to underflow to UINTMAX, making skbtailpointer() read far past the buffer.
Commit 23882b828c3c ("Bluetooth: RFCOMM: validate skb length in MCC handlers") fixed the same class of missing-length-check bugs in the MCC sub-handlers, but the top-level rfcommrecvframe() was left unfixed. KMSAN reports:
BUG: KMSAN: uninit-value in rfcommrun ... Uninit was created at: allocskb+0x474/0xb60 vhciwrite+0xe9/0x870
Fix this by rejecting frames smaller than sizeof(struct rfcommhdr) + 1 (the minimum frame must have a 3-byte header and a 1-byte FCS).
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to send to trigger the vulnerable code path?
The attacker needs to cause the RFCOMM receive path to process a malformed Bluetooth frame shorter than the minimum valid frame length. This includes a frame shorter than the 3-byte RFCOMM header plus 1-byte FCS, and specifically a zero-length frame.
What happens when a zero-length RFCOMM frame is processed?
The receive code decrements skb->len without first confirming that data is present, causing the length to underflow to UINT_MAX. Subsequent access through skb_tail_pointer() can then read far beyond the packet buffer.
How can this issue be mitigated if the fix cannot be deployed immediately?
The provided information does not specify a configuration workaround. Mitigation would need to prevent malformed RFCOMM frames from reaching the affected Linux kernel Bluetooth RFCOMM receive path.
How can administrators identify evidence of this issue?
KMSAN may report an uninitialized-value error in rfcomm_run. The report can trace the uninitialized data to skb allocation, including allocations associated with vhci_write.