In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: validate frame length before control and FCS access… (CVE-2026-98457)

The Linux kernel Bluetooth L2CAP component had a vulnerability where the function l2cap_data_rcv() would unpack a two-byte or four-byte control field without verifying that the frame length was sufficient, leading to potential out-of-bounds reads. Additionally, when CRC16 is enabled, l2cap_check_fcs() subtracts two bytes from the frame length without checking if enough bytes remain, causing a wraparound and subsequent out-of-bounds read during FCS access. The fix involves validating that the frame contains both the control field and, if enabled, the FCS before accessing these fields.

This vulnerability can cause out-of-bounds reads in the Bluetooth L2CAP processing in the Linux kernel, which may lead to kernel memory disclosure or instability. However, no known exploits in the wild have been reported. The impact is limited to the kernel Bluetooth stack and requires crafted Bluetooth frames to trigger.

A fix has been implemented in the Linux kernel to validate frame lengths before accessing control and FCS fields in the Bluetooth L2CAP code. Users should apply the official Linux kernel updates that include this patch. Since this is not a cloud service, remediation requires updating the affected Linux kernel versions once patches are released. Patch status is not explicitly confirmed in the provided data; users should consult the vendor advisory for current remediation guidance.