In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control… (CVE-2026-98602)

The Linux kernel's Bluetooth BNEP (Bluetooth Network Encapsulation Protocol) code contained multiple out-of-bounds read vulnerabilities. Specifically, in the functions bnep_rx_frame() and bnep_ctrl_frame(), insufficient validation of frame length allowed reading beyond buffer boundaries. The fix involved using pskb_may_pull() to ensure the presence of BNEP headers, control type bytes, filter counts, and extension headers before accessing them, and returning early after handling control frames to avoid fallthrough to Ethernet frame submission. Additionally, in bnep_net_xmit(), a check was added to verify that the skb length is at least the Ethernet header length before reading it, preventing out-of-bounds heap reads and potential information leaks on short AF_PACKET TX frames.

The vulnerability could lead to out-of-bounds reads in kernel memory when processing malformed Bluetooth BNEP frames, potentially causing information leakage or kernel instability. No known exploits in the wild have been reported. The impact is limited to systems using the affected Bluetooth BNEP code in the Linux kernel.

A fix has been implemented in the Linux kernel to address these out-of-bounds read issues by adding proper length checks and control flow corrections. Users should apply the official kernel updates that include these patches to remediate the vulnerability. Patch status is not explicitly confirmed in the provided data; users should consult the vendor advisory or Linux kernel mailing lists for the specific fixed versions and update accordingly.