{"id":"CVE-2026-98602","kind":"vulnerability","aliases":["CVE-2026-98602"],"related":[],"title":"Linux kernel: Bluetooth BNEP reads past short frames, leaking memory","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough\n\nFix multiple out-of-bounds reads in Bluetooth BNEP frame processing:\n\n1. In bnep_rx_frame() and bnep_ctrl_frame() (net/bluetooth/bnep/core.c),\n   use pskb_may_pull() to verify the BNEP header, control type byte,\n   filter count, and extension headers exist before reading them, and\n   return 0 after handling BNEP_CONTROL instead of falling through to\n   Ethernet frame submission when no extension headers follow.\n2. In bnep_net_xmit() (net/bluetooth/bnep/netdev.c), verify skb->len >=\n   ETH_HLEN with pskb_may_pull() before reading the 14-byte Ethernet\n   header to prevent an out-of-bounds heap read and infoleak on short\n   AF_PACKET TX frames.","summary":"The Linux kernel's Bluetooth BNEP driver reads packet headers and Ethernet headers without checking the frame is long enough, causing out-of-bounds heap reads. The sources do not say whether an attacker can reliably use this beyond reading kernel memory.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bluetooth","linux-kernel","runtime","self-hosted"],"not_affected_if":["bnep-module-not-loaded","no-bluetooth-hardware"],"how_to_check":"- Run `uname -r` and compare against the fixed kernel builds in the upstream kernel commit.\n- Check whether the Bluetooth BNEP module is loaded with `lsmod | grep bnep`.\n- unknown","fix":"- Update the Linux kernel to a release that includes the upstream BNEP fix from CVE-2026-98602.\n- unknown","status":"open","published_at":"2026-10-18T16:17:12+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:21:32+00:00","updated_at":"2026-10-25T05:21:32+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-25T05:21:32Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream BNEP fix from CVE-2026-98602.\n- unknown","reach":"local","title":"Linux kernel: Bluetooth BNEP reads past short frames, leaking memory","impact":"low","summary":"The Linux kernel's Bluetooth BNEP driver reads packet headers and Ethernet headers without checking the frame is long enough, causing out-of-bounds heap reads. The sources do not say whether an attacker can reliably use this beyond reading kernel memory.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","bluetooth","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Kernel memory contents may leak; code execution not established by sources.","analyst_note":"Find the affected kernel version range and the fixed stable commits in the NVD entry or kernel.org stable mailing list, and confirm whether a remote attacker can reach BNEP.","how_to_check":"- Run `uname -r` and compare against the fixed kernel builds in the upstream kernel commit.\n- Check whether the Bluetooth BNEP module is loaded with `lsmod | grep bnep`.\n- unknown","needs_analyst":true,"not_affected_if":["no-bluetooth-hardware","bnep-module-not-loaded"],"who_is_affected":"Systems running a Linux kernel with Bluetooth BNEP support, typically desktops and devices that use Bluetooth personal area networking. Machines without Bluetooth hardware or with the bnep module not loaded are unlikely to be exposed. The sources do not list specific affected kernel versions.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000666,"input_tokens":3561,"output_tokens":619,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-98602':13A,16A '0':138C '1':105C '14':174C '2':156C 'af':191C 'attack':59B 'beyond':64B 'bluetooth':3A,17B,29B,78C,101C 'bnep':4A,30B,79C,102C,107C,111C,122C,141C,158C 'bound':49B,84C,98C,184C 'byte':126C,175C 'caus':45B 'check':39B 'control':91C,124C,142C 'count':128C 'ctrl':112C 'cve':11A,14A 'driver':31B 'enough':44B 'eth':165C 'ethernet':36B,148C,176C 'exist':132C 'extens':130C,153C 'fall':145C 'fallthrough':92C 'filter':127C 'fix':80C,93C 'follow':73C,155C 'frame':8A,41B,89C,103C,109C,113C,149C,194C 'handl':140C 'header':34B,37B,123C,131C,154C,177C 'heap':50B,185C 'hlen':166C 'host':24B 'infoleak':188C 'instead':143C 'kernel':2A,20B,27B,66B,71C 'leak':9A 'len':164C 'linux':1A,19B,26B,70C 'linux-kernel':18B 'long':43B 'may':117C,169C 'memori':10A,67B 'multipl':94C 'net':159C 'net/bluetooth/bnep/core.c':114C 'net/bluetooth/bnep/netdev.c':161C 'out-of-bound':46B,81C,95C,181C 'packet':33B,192C 'past':6A 'prevent':179C 'process':104C 'pskb':116C,168C 'pull':118C,170C 'read':5A,32B,51B,65B,85C,99C,134C,172C,186C 'reliabl':61B 'resolv':77C 'return':137C 'runtim':21B 'rx':108C 'rx/tx':88C 'say':56B 'self':23B 'self-host':22B 'short':7A,87C,190C 'skb':163C 'sourc':53B 'submiss':150C 'tx':193C 'type':125C 'use':62B,115C 'verifi':120C,162C 'vulner':74C 'whether':57B 'without':38B 'xmit':160C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with Bluetooth BNEP support, typically desktops and devices that use Bluetooth personal area networking. Machines without Bluetooth hardware or with the bnep module not loaded are unlikely to be exposed. The sources do not list specific affected kernel versions.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:12+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98602","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98602","severity":null,"published_at":"2026-10-18T16:17:12+00:00","modified_at":"2026-10-19T10:19:21+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}