CVE-2026-90088 Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop
A remote attacker can cause a denial of service in the Linux kernel by sending a Bluetooth RFCOMM frame with a zero MTU, triggering an infinite loop and memory exhaustion.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-90088?
CVE-2026-90088 is a denial of service vulnerability in Linux, published on 17 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop
rfcomm_apply_pn() accepts the MTU value from a remote PN (Parameter Negotiation) frame without checking for zero. When the remote peer sends an MTU of zero, d->mtu is set to 0. This causes the sendmsg path to enter an infinite loop when fragmenting data, as each fragment has size == min_t(size_t, len, 0) == 0, so the remaining length never decreases. The infinite allocation of zero-length skbs exhausts all system memory.
Fix by clamping d->mtu to RFCOMM_DEFAULT_MTU when the negotiated value is zero, consistent with the initial value assigned in rfcomm_dlc_alloc().
Which versions are affected by CVE-2026-90088?
How do I fix CVE-2026-90088?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-90088 being exploited?
There is no known exploitation of CVE-2026-90088 in the wild and no public exploit code.
Sources
Also known as AZL-102227, BELL-CVE-2026-90088, DEBIAN-CVE-2026-90088, GHSA-j6jv-mcf5-3925, UBUNTU-CVE-2026-90088.