VulnerabilityPublished 18 Oct 2026

CVE-2026-98457: Linux kernel · Bluetooth: L2CAP: validate frame length before control and FCS access

Source GCVE Database

Authoritative record:CVE-2026-98457· Medium

Not known to be exploited · fixed in f557274af7b94b6134692e6f26b880f1e34c15bf : update Linux kernel when convenient.

Data as of 26 Oct 2026, 13:47 UTC

Severity

Medium

Rated by Threat Radar · CVSS not yet scored by NVD

EPSS: 0.1% chance of exploitation in 30 days – higher than 7% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in f557274af7b94b6134692e6f26b880f1e34c15bf, c6a288e6001bcce16553c3853e0f5a45eaaf85c7, 4373ba79a267947e771c438507f7b103e30bdb21 +5

Exploitation evidence

Disclosed: evidence found.
CVE published 18 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

ghsa-8cwv-pj99-4m5f

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 1c2acffb76d4bc5fd27c4ea55cc27ad8ead10f9a, < f557274af7b94b6134692e6f26b880f1e34c15bf	Fixed in f557274af7b94b6134692e6f26b880f1e34c15bf
LinuxLinux	Affected ≥ 1c2acffb76d4bc5fd27c4ea55cc27ad8ead10f9a, < c6a288e6001bcce16553c3853e0f5a45eaaf85c7	Fixed in c6a288e6001bcce16553c3853e0f5a45eaaf85c7
LinuxLinux	Affected ≥ 1c2acffb76d4bc5fd27c4ea55cc27ad8ead10f9a, < 4373ba79a267947e771c438507f7b103e30bdb21	Fixed in 4373ba79a267947e771c438507f7b103e30bdb21
LinuxLinux	Affected ≥ 1c2acffb76d4bc5fd27c4ea55cc27ad8ead10f9a, < 965bd88ed4b4763cb765dd65885adcfa588c6b14	Fixed in 965bd88ed4b4763cb765dd65885adcfa588c6b14
LinuxLinux	Affected ≥ 1c2acffb76d4bc5fd27c4ea55cc27ad8ead10f9a, < 8c7556c7cd17e073bbefdc4a9a4694a207544c37	Fixed in 8c7556c7cd17e073bbefdc4a9a4694a207544c37
LinuxLinux	Affected ≥ 1c2acffb76d4bc5fd27c4ea55cc27ad8ead10f9a, < 6c78a213d9070b610c7f418af2c25b66180b7e37	Fixed in 6c78a213d9070b610c7f418af2c25b66180b7e37

AI-suggested

A fix has been implemented in the Linux kernel to validate frame lengths before accessing control and FCS fields in the Bluetooth L2CAP code. Users should apply the official Linux kernel updates that include this patch. Patch status is not explicitly confirmed in the provided data; users should consult the vendor advisory for current remediation guidance.

Description

A vulnerability in the Linux kernel's Bluetooth L2CAP implementation allows out-of-bounds reads due to insufficient validation of frame length before accessing control and FCS fields. This occurs in the l2cap_data_rcv() function when unpacking control fields without ensuring their presence, and in l2cap_check_fcs() when CRC16 is enabled and frame length checks are inadequate.

References

Community reviews

Loading reviews…