VulnerabilityPublished 18 Oct 2026

CVE-2026-98457: Linux kernel · Bluetooth: L2CAP: validate frame length before control and FCS access

Affects Linux kernelSource CVE Database V5

Not known to be exploited · fixed in f557274af7b94b6134692e6f26b880f1e34c15bf : update Linux kernel when convenient.

Data as of 26 Oct 2026, 13:47 UTC

Severity

Medium

Rated Medium by Threat Radar's AI analysis · CVSS not yet scored by NVD

EPSS: 0.1% chance of exploitation in 30 days – higher than 7% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in f557274af7b94b6134692e6f26b880f1e34c15bf, c6a288e6001bcce16553c3853e0f5a45eaaf85c7, 4373ba79a267947e771c438507f7b103e30bdb21 +5

Exploitation evidence

Disclosed: evidence found.
CVE published 18 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 1c2acffb76d4bc5fd27c4ea55cc27ad8ead10f9a, < f557274af7b94b6134692e6f26b880f1e34c15bf	Fixed in f557274af7b94b6134692e6f26b880f1e34c15bf
LinuxLinux	Affected ≥ 1c2acffb76d4bc5fd27c4ea55cc27ad8ead10f9a, < c6a288e6001bcce16553c3853e0f5a45eaaf85c7	Fixed in c6a288e6001bcce16553c3853e0f5a45eaaf85c7
LinuxLinux	Affected ≥ 1c2acffb76d4bc5fd27c4ea55cc27ad8ead10f9a, < 4373ba79a267947e771c438507f7b103e30bdb21	Fixed in 4373ba79a267947e771c438507f7b103e30bdb21
LinuxLinux	Affected ≥ 1c2acffb76d4bc5fd27c4ea55cc27ad8ead10f9a, < 965bd88ed4b4763cb765dd65885adcfa588c6b14	Fixed in 965bd88ed4b4763cb765dd65885adcfa588c6b14
LinuxLinux	Affected ≥ 1c2acffb76d4bc5fd27c4ea55cc27ad8ead10f9a, < 8c7556c7cd17e073bbefdc4a9a4694a207544c37	Fixed in 8c7556c7cd17e073bbefdc4a9a4694a207544c37
LinuxLinux	Affected ≥ 1c2acffb76d4bc5fd27c4ea55cc27ad8ead10f9a, < 6c78a213d9070b610c7f418af2c25b66180b7e37	Fixed in 6c78a213d9070b610c7f418af2c25b66180b7e37

AI-suggested

A fix is available and has been applied in specific Linux kernel commits. Users and administrators should update affected Linux kernel versions to the fixed releases identified by the provided commit hashes to remediate this issue.

Description

A vulnerability in the Linux kernel's Bluetooth L2CAP implementation allows out-of-bounds reads due to improper validation of frame length before accessing control and FCS fields. This flaw affects version 2.6.32 and is fixed in later commits. The issue arises when short frames are processed without verifying their length, potentially leading to memory access beyond the buffer.

Impact

This vulnerability can cause out-of-bounds memory reads in the Bluetooth L2CAP processing path of the Linux kernel. While no direct exploit or active exploitation is reported, such memory access errors could potentially lead to system instability or information disclosure under certain conditions.

Summary

The Linux kernel Bluetooth L2CAP component's l2cap_data_rcv() function unpacks control fields without first ensuring the frame contains enough data, causing out-of-bounds reads for short ERTM or streaming-mode frames. Additionally, when CRC16 is enabled, l2cap_check_fcs() subtracts two from the skb length without checking if sufficient bytes remain, leading to a wraparound and subsequent out-of-bounds FCS reads. The vulnerability is addressed by validating the presence of both control and FCS fields before access.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 26 Oct 2026, 11:06 UTC

Technical details

References

Community reviews

Related threats