PT-2026-52349 · Linux · Linux

Publicado 2026-06-25 · Atualizado 2026-06-25 · CVE-2026-53254

Mitre

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: RFCOMM: validate skb length in MCC handlers

The RFCOMM MCC handlers cast skb->data to protocol-specific structs without validating skb->len first. A malicious remote device can send truncated MCC frames and trigger out-of-bounds reads in these handlers.

Fix this by using skb pull data() to validate and access the required data before dereferencing it.

rfcomm recv rpn() requires special handling since ETSI TS 07.10 allows 1-byte RPN requests. Handle this by validating only the DLCI byte first, and validating the full struct only when len > 1.

Identificadores relacionados

CVE-2026-53254

Produtos afetados

Linux

Referências · 8

• https://git.kernel.org/stable/c/7c15c7c2878957cbfed93bcc29c13fdace464254 · Nota
• https://git.kernel.org/stable/c/23882b828c3c8c51d0c946446a396b10abb3b16b · Nota
• https://git.kernel.org/stable/c/08b9c1fbe78f4ad3f6250c6541cfaabdbeb81997 · Nota
• https://git.kernel.org/stable/c/98377e6b1a1a56561ec66a181573ea2b61b2079e · Nota
• https://git.kernel.org/stable/c/3eabc6d47a0ad22b053329997aaf0ec1e581e392 · Nota
• https://git.kernel.org/stable/c/0d637136ce89f9a2309b2c3502402ce400dab0ef · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-53254 · Nota de Segurança
• https://git.kernel.org/stable/c/1b070ac9e99c2c2c3a8112943ca98ab6fca7f10c · Nota