{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-98108","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-09-25T10:25:14.316Z","datePublished":"2026-09-25T10:35:56.935Z","dateUpdated":"2026-10-03T11:02:26.927Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-10-03T11:02:26.927Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan\n\nl2cap_new_connection() sets default value of channel mode to match the\nparent channel.  l2cap_le_connect_req() left this at the default, and\ncreated L2CAP_MODE_EXT_FLOWCTL channels if listening pchan has that\nmode.  This causes FLAG_DEFER_SETUP channels to reply to\nL2CAP_LE_CONN_REQ with L2CAP_ECRED_CONN_RSP, which is incorrect.\n\nIt can also result to stack OOB write (of l2cap_alloc_cid determined\nvalues) in l2cap_ecred_rsp_defer(), as l2cap_le_connect_req() does not\nlimit maximum number of deferred channels or check for duplicate ident.\n\nFix by setting chan->mode correctly in l2cap_le_connect_req().\n\nAlso check channel mode in l2cap_ecred_rsp_defer(), and do WARN_ON_ONCE\ninstead of OOB write to make it less brittle."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:A - The malformed input is a series of L2CAP_LE_CONN_REQ signalling commands, all using the same ident, sent over a BLE link to l2cap_le_connect_req(). The attacker must be within Bluetooth radio range, so the vector is Adjacent.\nAC:H - The OOB write only happens if the target runs an LE listener in BT_MODE_EXT_FLOWCTL with DEFER_SETUP, whose children inherit EXT_FLOWCTL through l2cap_new_connection(). The attacker cannot create that listener. Once it exists, the attacker controls how many LE_CONN_REQs share one ident, and the service's own recvmsg() triggers the write.\nPR:N - l2cap_le_connect_req() only checks the listener's sec_level through smp_sufficient_security(). An LE listener defaults to BT_SECURITY_LOW, so an unpaired peer can open the channels, and Just Works pairing is available otherwise.\nUI:N - No human action is needed. The listening service's normal accept/recvmsg on a deferred child calls l2cap_sock_recvmsg(), which then calls __l2cap_ecred_conn_rsp_defer().\nS:U - The memory corruption stays within the kernel's own security authority. No VM or hardware isolation boundary is crossed.\nC:H - l2cap_ecred_rsp_defer() writes CIDs past the 5-entry scid[] into the adjacent 'count' field, which then steers later writes to attacker-influenced offsets on the kernel stack. Corruption of this kind can be leveraged for disclosure.\nI:H - This is an out-of-bounds write on the kernel stack in __l2cap_ecred_conn_rsp_defer(). The written values are l2cap_alloc_cid() CIDs whose count and order the attacker influences, and the write can reach the saved frame state.\nA:H - Stack corruption in __l2cap_ecred_conn_rsp_defer() causes a stack-protector panic or an oops, crashing the kernel, and the peer can repeat it."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/bluetooth/l2cap_core.c"],"versions":[{"version":"15f02b91056253e8cdc592888f431da0731337b8","lessThan":"ad0f44a3f1f688558ed876a0702bc2c82b0df689","status":"affected","versionType":"git"},{"version":"15f02b91056253e8cdc592888f431da0731337b8","lessThan":"564ae0e05e598aa895b9dbd18cb7d6eb64752869","status":"affected","versionType":"git"},{"version":"15f02b91056253e8cdc592888f431da0731337b8","lessThan":"aab17938998b29e75c3324763411aef3e300fc67","status":"affected","versionType":"git"},{"version":"15f02b91056253e8cdc592888f431da0731337b8","lessThan":"0e1fc7cab95ad958e55d70a5dfaaea687c9c639f","status":"affected","versionType":"git"},{"version":"15f02b91056253e8cdc592888f431da0731337b8","lessThan":"1074bcc57f741223f9fa82ce6afe5c3d783e4d10","status":"affected","versionType":"git"},{"version":"15f02b91056253e8cdc592888f431da0731337b8","lessThan":"5d5a625cbc854d4c4f68e4b16fcf6e682d9a9ed1","status":"affected","versionType":"git"},{"version":"15f02b91056253e8cdc592888f431da0731337b8","lessThan":"6cb79e6499228cfdbd4b3301371ce74d01cd2f80","status":"affected","versionType":"git"},{"version":"15f02b91056253e8cdc592888f431da0731337b8","lessThan":"4ef05db5b08b176a551b4a6287372045998806b0","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/bluetooth/l2cap_core.c"],"versions":[{"version":"5.7","status":"affected"},{"version":"0","lessThan":"5.7","status":"unaffected","versionType":"semver"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","status":"unaffected","versionType":"semver"},{"version":"7.3-rc2","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.7","versionEndExcluding":"5.10.271"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.7","versionEndExcluding":"5.15.222"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.7","versionEndExcluding":"6.1.189"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.7","versionEndExcluding":"6.6.158"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.7","versionEndExcluding":"6.12.111"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.7","versionEndExcluding":"6.18.53"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.7","versionEndExcluding":"7.2.7"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.7","versionEndExcluding":"7.3-rc2"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/ad0f44a3f1f688558ed876a0702bc2c82b0df689"},{"url":"https://git.kernel.org/stable/c/564ae0e05e598aa895b9dbd18cb7d6eb64752869"},{"url":"https://git.kernel.org/stable/c/aab17938998b29e75c3324763411aef3e300fc67"},{"url":"https://git.kernel.org/stable/c/0e1fc7cab95ad958e55d70a5dfaaea687c9c639f"},{"url":"https://git.kernel.org/stable/c/1074bcc57f741223f9fa82ce6afe5c3d783e4d10"},{"url":"https://git.kernel.org/stable/c/5d5a625cbc854d4c4f68e4b16fcf6e682d9a9ed1"},{"url":"https://git.kernel.org/stable/c/6cb79e6499228cfdbd4b3301371ce74d01cd2f80"},{"url":"https://git.kernel.org/stable/c/4ef05db5b08b176a551b4a6287372045998806b0"}],"title":"Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan","x_generator":{"engine":"bippy-1.2.0"}}}}