{"id":"CVE-2026-98600","kind":"vulnerability","aliases":["CVE-2026-98600"],"related":[],"title":"Linux kernel: short RFCOMM frames can leak header bytes to Bluetooth applications","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame()\n\nWhile rfcomm_recv_frame() verifies that skb->len is at least\nsizeof(*hdr) + 1 (4 bytes: 3-byte header + 1-byte FCS), an RFCOMM frame\nwith an extended 2-byte length field (!__test_ea(hdr->len)) has a 4-byte\nheader plus a 1-byte FCS (5 bytes minimum, sizeof(*hdr) + 2).\n\nWhen a 4-byte RFCOMM frame with EA == 0 arrives:\n1. The initial skb->len < sizeof(*hdr) + 1 check passes (4 < 4 is false).\n2. Trimming the FCS byte decrements skb->len to 3.\n3. If __check_fcs() succeeds, skb_pull(skb, 4) fails (4 > 3) and returns\n   NULL without advancing skb->data.\n4. Because the return value of skb_pull() is ignored, the un-pulled\n   3-byte struct rfcomm_hdr remains at skb->data and is either queued as\n   application payload via rfcomm_recv_data() or parsed as a multiplexer\n   control command via rfcomm_recv_mcc() on DLCI 0.\n\nFix this by extending the length check in rfcomm_recv_frame() to also\nrequire skb->len >= sizeof(*hdr) + 2 when !__test_ea(hdr->len).","summary":"A malformed 4-byte RFCOMM frame with the extended-length bit clear is not rejected, so the kernel passes the unparsed 3-byte header on as application data or as a multiplexer control command. The sources do not say what an attacker can do beyond this, so the impact is unconfirmed.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bluetooth","linux-kernel","package","self-hosted"],"not_affected_if":["bluetooth-disabled"],"how_to_check":"- unknown","fix":"- Update the Linux kernel to a release that includes the upstream RFCOMM fix (the commit that extends the length check in rfcomm_recv_frame()); exact fixed versions are not in the sources.","status":"open","published_at":"2026-10-18T16:17:12+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:21:35+00:00","updated_at":"2026-10-25T05:21:35+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-10-25T05:21:35Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream RFCOMM fix (the commit that extends the length check in rfcomm_recv_frame()); exact fixed versions are not in the sources.","reach":"network","title":"Linux kernel: short RFCOMM frames can leak header bytes to Bluetooth applications","impact":"medium","summary":"A malformed 4-byte RFCOMM frame with the extended-length bit clear is not rejected, so the kernel passes the unparsed 3-byte header on as application data or as a multiplexer control command. The sources do not say what an attacker can do beyond this, so the impact is unconfirmed.","category":"package","nicknames":[],"who_cares":["linux-kernel","bluetooth","self-hosted"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown; kernel memory header bytes may reach applications","analyst_note":"Find the fixed kernel versions and the upstream commit from the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-98600) and confirm whether a nearby attacker must pair first.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["bluetooth-disabled"],"who_is_affected":"Systems running a Linux kernel with Bluetooth RFCOMM support enabled and a Bluetooth adapter in use are the ones to look at. The sources do not say which kernel versions are vulnerable or whether an attacker needs to be paired or nearby, so systems with Bluetooth disabled or the bluetooth module not loaded can likely skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000673,"input_tokens":3740,"output_tokens":597,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-98600':15A,18A '0':94C,160C,252C '1':113C,119C,143C,162C,169C '2':128C,151C,176C,271C '3':49B,116C,185C,186C,197C,219C '4':29B,114C,138C,154C,172C,173C,194C,196C,205C '5':146C 'advanc':202C 'also':265C 'applic':12A,54B,233C 'arriv':161C 'attack':69B 'beyond':72B 'bit':38B 'bluetooth':11A,19B,89C 'byte':9A,30B,50B,115C,117C,120C,129C,139C,144C,147C,155C,180C,220C 'check':170C,188C,259C 'clear':39B 'command':61B,245C 'control':60B,244C 'cve':13A,16A 'data':55B,204C,227C,238C 'decrement':181C 'dlci':251C 'ea':93C,133C,159C,274C 'either':230C 'extend':36B,127C,256C 'extended-length':35B 'fail':195C 'fals':175C 'fcs':121C,145C,179C,189C 'field':131C 'fix':253C 'follow':84C 'frame':5A,32B,95C,99C,103C,124C,157C,263C 'hdr':112C,134C,150C,168C,223C,270C,275C 'header':8A,51B,118C,140C 'host':26B 'ignor':214C 'impact':76B 'initi':164C 'kernel':2A,22B,45B,82C 'leak':7A 'least':110C 'len':107C,135C,166C,183C,268C,276C 'length':37B,130C,258C 'linux':1A,21B,81C 'linux-kernel':20B 'malform':28B 'mcc':249C 'minimum':148C 'multiplex':59B,243C 'null':200C 'packag':23B 'pars':240C 'pass':46B,171C 'payload':234C 'plus':141C 'pull':192C,212C,218C 'queu':231C 'recv':98C,102C,237C,248C,262C 'reject':42B,91C 'remain':224C 'requir':266C 'resolv':88C 'return':199C,208C 'rfcomm':4A,31B,90C,97C,101C,123C,156C,222C,236C,247C,261C 'say':66B 'self':25B 'self-host':24B 'short':3A,92C 'sizeof':111C,149C,167C,269C 'skb':106C,165C,182C,191C,193C,203C,211C,226C,267C 'sourc':63B 'struct':221C 'succeed':190C 'test':132C,273C 'trim':177C 'un':217C 'un-pul':216C 'unconfirm':78B 'unpars':48B 'valu':209C 'verifi':104C 'via':235C,246C 'vulner':85C 'without':201C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with Bluetooth RFCOMM support enabled and a Bluetooth adapter in use are the ones to look at. The sources do not say which kernel versions are vulnerable or whether an attacker needs to be paired or nearby, so systems with Bluetooth disabled or the bluetooth module not loaded can likely skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:12+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98600","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98600","severity":null,"published_at":"2026-10-18T16:17:12+00:00","modified_at":"2026-10-19T10:19:21+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}