CVE-2026-97408: Bluetooth: L2CAP: validate connectionless PSM length
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: L2CAP: validate connectionless PSM length
Connectionless L2CAP frames carry a two-byte PSM at the start of the payload. l2caprecvframe() currently reads that PSM unconditionally after validating only the outer L2CAP length.
A malformed connectionless frame with a zero- or one-byte payload can therefore make the parser read beyond the advertised skb payload and use tailroom bytes as part of the PSM. A VHCI-backed QEMU reproducer injected a one-byte connectionless payload and reached the unchecked read.
Reject connectionless frames that cannot contain the PSM before reading or pulling it. This preserves all valid connectionless frames while dropping only structurally incomplete packets.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Validate that a connectionless L2CAP frame contains the full two-byte PSM before reading it, and reject structurally incomplete zero- or one-byte-payload frames.
Event History
Frequently Asked Questions
What does an attacker need to send to trigger the flawed parsing path?
They need to deliver a malformed connectionless L2CAP frame whose payload is zero or one byte long. The vulnerable parser attempts to read the required two-byte PSM despite the payload being too short.
Which systems are realistically exposed?
Systems using the Linux kernel Bluetooth L2CAP receive path are potentially exposed when they can receive connectionless L2CAP frames. The provided data does not identify specific kernel versions, Bluetooth hardware, or configuration requirements.
What changes after applying the fix?
The kernel rejects connectionless frames that are too short to contain the two-byte PSM before attempting to read it. Valid connectionless frames are preserved; only structurally incomplete packets are dropped.
Can this condition be detected from the provided information?
A reproducer can inject a one-byte connectionless payload through a VHCI-backed QEMU setup and reach the unchecked read on an affected kernel. The provided data does not specify a log message, crash signature, or runtime indicator for identifying prior exploitation.