In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame() While… (CVE-2026-98600)

The Linux kernel's Bluetooth RFCOMM code had a vulnerability where frames with an extended 2-byte length field and EA=0 were not properly validated for length. Specifically, rfcomm_recv_frame() checked that skb->len was at least sizeof(*hdr) + 1 (4 bytes), but frames requiring a 5-byte minimum length (sizeof(*hdr) + 2) passed this check incorrectly. This caused skb_pull() to fail silently, leaving a 3-byte header unprocessed and potentially misinterpreted as application payload or multiplexer control commands. The fix involved extending the length check to require skb->len >= sizeof(*hdr) + 2 when the extended length field is present.

This vulnerability could allow malformed Bluetooth RFCOMM frames to be processed incorrectly by the Linux kernel, potentially leading to unexpected behavior in Bluetooth communication. However, no specific exploitation details or impacts such as privilege escalation or denial of service are described in the provided data.

A fix has been applied to the Linux kernel to extend the length validation in rfcomm_recv_frame(). Users should update to the fixed kernel version once available. Patch status is not explicitly confirmed in the provided data; check the vendor advisory for current remediation guidance.