CVE-2026-53254 — Bluetooth: RFCOMM: validate skb length in MCC handlers

Affected: Linux

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: RFCOMM: validate skb length in MCC handlers

The RFCOMM MCC handlers cast skb->data to protocol-specific structs without validating skb->len first. A malicious remote device can send truncated MCC frames and trigger out-of-bounds reads in these handlers.

Fix this by using skb_pull_data() to validate and access the required data before dereferencing it.

rfcomm_recv_rpn() requires special handling since ETSI TS 07.10 allows 1-byte RPN requests. Handle this by validating only the DLCI byte first, and validating the full struct only when len > 1.

Most recent entries from all

CVE-2026-53254 — Bluetooth: RFCOMM: validate skb length in MCC handlers