CVE-2026-97408

Bluetooth: L2CAP: validate connectionless PSM length

State: Published
Severity: Not scored
Published: Sep 24, 2026
Updated: Oct 3, 2026
Reserved: Sep 24, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: L2CAP: validate connectionless PSM length

Connectionless L2CAP frames carry a two-byte PSM at the start of the payload. l2cap_recv_frame() currently reads that PSM unconditionally after validating only the outer L2CAP length.

A malformed connectionless frame with a zero- or one-byte payload can therefore make the parser read beyond the advertised skb payload and use tailroom bytes as part of the PSM. A VHCI-backed QEMU reproducer injected a one-byte connectionless payload and reached the unchecked read.

Reject connectionless frames that cannot contain the PSM before reading or pulling it. This preserves all valid connectionless frames while dropping only structurally incomplete packets.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 8104cd9859b6de0826cffa68adf2c1461185823bAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 9448e6f693fcf1f0ac4ee648a9b2cc83bfe4a982Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 22fc1ce4e37c81d4e7aac01566ebdc232214540dAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 72e26293a231f63a856340d3a1f0f5fc29bf87e5Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 3502ede8aed3c3ee1786d952a11054ac737d1a38Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before ae69dca122f6d6046a68cf40153e6e827c77ff5cAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before a40a5f922546b3bd7c094d882b29177db4f2abe0Affected
LinuxLinux	2.6.12Affected before 2.6.12Not affected 5.10.271 through 5.10.Not affected 5.15.222 through 5.15.Not affected 6.1.189 through 6.1.Not affected 6.6.158 through 6.6.Not affected 6.12.111 through 6.12.Not affected 6.18.53 through 6.18.Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 8104cd9859b6de0826cffa68adf2c1461185823bAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 9448e6f693fcf1f0ac4ee648a9b2cc83bfe4a982Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 22fc1ce4e37c81d4e7aac01566ebdc232214540dAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 72e26293a231f63a856340d3a1f0f5fc29bf87e5Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 3502ede8aed3c3ee1786d952a11054ac737d1a38Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before ae69dca122f6d6046a68cf40153e6e827c77ff5cAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before a40a5f922546b3bd7c094d882b29177db4f2abe0Affected

LinuxLinux

2.6.12Affected
before 2.6.12Not affected
5.10.271 through 5.10.*Not affected
5.15.222 through 5.15.*Not affected
6.1.189 through 6.1.*Not affected
6.6.158 through 6.6.*Not affected
6.12.111 through 6.12.*Not affected
6.18.53 through 6.18.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.