CVE-2026-98457 Bluetooth: L2CAP: validate frame length before control and FCS access
A missing length check in the Linux kernel Bluetooth L2CAP handler allows out-of-bounds reads, potentially causing crashes or information disclosure.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98457?
CVE-2026-98457 is a memory corruption vulnerability in Linux, published on 18 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: L2CAP: validate frame length before control and FCS access
l2cap_data_rcv() unpacks either a two-byte or four-byte control field without first ensuring that it is present. A short ERTM or streaming-mode frame can therefore cause an out-of-bounds read.
There is a second short-frame case when CRC16 is enabled. After the control field is pulled, l2cap_check_fcs() subtracts two from skb->len without checking it. If fewer than two bytes remain, the subtraction wraps; skb_trim() leaves the buffer unchanged and the subsequent FCS load reads past the logical end of the frame.
Validate that the frame contains both its control field and, when enabled, its FCS before either field is accessed.
Which versions are affected by CVE-2026-98457?
How do I fix CVE-2026-98457?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-98457 being exploited?
There is no known exploitation of CVE-2026-98457 in the wild and no public exploit code.
Sources
Also known as AZL-109407, BELL-CVE-2026-98457, DEBIAN-CVE-2026-98457, GHSA-8cwv-pj99-4m5f, UBUNTU-CVE-2026-98457.