{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98108", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.316Z", "datePublished": "2026-09-25T10:35:56.935Z", "dateUpdated": "2026-10-19T09:14:00.739Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:14:00.739Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan\n\nl2cap_new_connection() sets default value of channel mode to match the\nparent channel. l2cap_le_connect_req() left this at the default, and\ncreated L2CAP_MODE_EXT_FLOWCTL channels if listening pchan has that\nmode. This causes FLAG_DEFER_SETUP channels to reply to\nL2CAP_LE_CONN_REQ with L2CAP_ECRED_CONN_RSP, which is incorrect.\n\nIt can also result to stack OOB write (of l2cap_alloc_cid determined\nvalues) in l2cap_ecred_rsp_defer(), as l2cap_le_connect_req() does not\nlimit maximum number of deferred channels or check for duplicate ident.\n\nFix by setting chan->mode correctly in l2cap_le_connect_req().\n\nAlso check channel mode in l2cap_ecred_rsp_defer(), and do WARN_ON_ONCE\ninstead of OOB write to make it less brittle."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.5, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:A - The malformed input is a series of L2CAP_LE_CONN_REQ signalling commands, all using the same ident, sent over a BLE link to l2cap_le_connect_req(). The attacker must be within Bluetooth radio range, so the vector is Adjacent.\nAC:H - The OOB write only happens if the target runs an LE listener in BT_MODE_EXT_FLOWCTL with DEFER_SETUP, whose children inherit EXT_FLOWCTL through l2cap_new_connection(). The attacker cannot create that listener. Once it exists, the attacker controls how many LE_CONN_REQs share one ident, and the service's own recvmsg() triggers the write.\nPR:N - l2cap_le_connect_req() only checks the listener's sec_level through smp_sufficient_security(). An LE listener defaults to BT_SECURITY_LOW, so an unpaired peer can open the channels, and Just Works pairing is available otherwise.\nUI:N - No human action is needed. The listening service's normal accept/recvmsg on a deferred child calls l2cap_sock_recvmsg(), which then calls __l2cap_ecred_conn_rsp_defer().\nS:U - The memory corruption stays within the kernel's own security authority. No VM or hardware isolation boundary is crossed.\nC:H - l2cap_ecred_rsp_defer() writes CIDs past the 5-entry scid[] into the adjacent 'count' field, which then steers later writes to attacker-influenced offsets on the kernel stack. Corruption of this kind can be leveraged for disclosure.\nI:H - This is an out-of-bounds write on the kernel stack in __l2cap_ecred_conn_rsp_defer(). The written values are l2cap_alloc_cid() CIDs whose count and order the attacker influences, and the write can reach the saved frame state.\nA:H - Stack corruption in __l2cap_ecred_conn_rsp_defer() causes a stack-protector panic or an oops, crashing the kernel, and the peer can repeat it."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/bluetooth/l2cap_core.c"], "versions": [{"version": "15f02b91056253e8cdc592888f431da0731337b8", "lessThan": "ad0f44a3f1f688558ed876a0702bc2c82b0df689", "status": "affected", "versionType": "git"}, {"version": "15f02b91056253e8cdc592888f431da0731337b8", "lessThan": "564ae0e05e598aa895b9dbd18cb7d6eb64752869", "status": "affected", "versionType": "git"}, {"version": "15f02b91056253e8cdc592888f431da0731337b8", "lessThan": "aab17938998b29e75c3324763411aef3e300fc67", "status": "affected", "versionType": "git"}, {"version": "15f02b91056253e8cdc592888f431da0731337b8", "lessThan": "0e1fc7cab95ad958e55d70a5dfaaea687c9c639f", "status": "affected", "versionType": "git"}, {"version": "15f02b91056253e8cdc592888f431da0731337b8", "lessThan": "1074bcc57f741223f9fa82ce6afe5c3d783e4d10", "status": "affected", "versionType": "git"}, {"version": "15f02b91056253e8cdc592888f431da0731337b8", "lessThan": "5d5a625cbc854d4c4f68e4b16fcf6e682d9a9ed1", "status": "affected", "versionType": "git"}, {"version": "15f02b91056253e8cdc592888f431da0731337b8", "lessThan": "6cb79e6499228cfdbd4b3301371ce74d01cd2f80", "status": "affected", "versionType": "git"}, {"version": "15f02b91056253e8cdc592888f431da0731337b8", "lessThan": "4ef05db5b08b176a551b4a6287372045998806b0", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/bluetooth/l2cap_core.c"], "versions": [{"version": "5.7", "status": "affected"}, {"version": "0", "lessThan": "5.7", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.271", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.222", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.189", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.158", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.111", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.53", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.7", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "5.10.271"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "5.15.222"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "6.1.189"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "6.6.158"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "6.12.111"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "6.18.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "7.2.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/ad0f44a3f1f688558ed876a0702bc2c82b0df689"}, {"url": "https://git.kernel.org/stable/c/564ae0e05e598aa895b9dbd18cb7d6eb64752869"}, {"url": "https://git.kernel.org/stable/c/aab17938998b29e75c3324763411aef3e300fc67"}, {"url": "https://git.kernel.org/stable/c/0e1fc7cab95ad958e55d70a5dfaaea687c9c639f"}, {"url": "https://git.kernel.org/stable/c/1074bcc57f741223f9fa82ce6afe5c3d783e4d10"}, {"url": "https://git.kernel.org/stable/c/5d5a625cbc854d4c4f68e4b16fcf6e682d9a9ed1"}, {"url": "https://git.kernel.org/stable/c/6cb79e6499228cfdbd4b3301371ce74d01cd2f80"}, {"url": "https://git.kernel.org/stable/c/4ef05db5b08b176a551b4a6287372045998806b0"}], "title": "Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/bluetooth/l2cap_core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "ad0f44a3f1f688558ed876a0702bc2c82b0df689", "status": "affected", "version": "15f02b91056253e8cdc592888f431da0731337b8", "versionType": "git"}, {"lessThan": "564ae0e05e598aa895b9dbd18cb7d6eb64752869", "status": "affected", "version": "15f02b91056253e8cdc592888f431da0731337b8", "versionType": "git"}, {"lessThan": "aab17938998b29e75c3324763411aef3e300fc67", "status": "affected", "version": "15f02b91056253e8cdc592888f431da0731337b8", "versionType": "git"}, {"lessThan": "0e1fc7cab95ad958e55d70a5dfaaea687c9c639f", "status": "affected", "version": "15f02b91056253e8cdc592888f431da0731337b8", "versionType": "git"}, {"lessThan": "1074bcc57f741223f9fa82ce6afe5c3d783e4d10", "status": "affected", "version": "15f02b91056253e8cdc592888f431da0731337b8", "versionType": "git"}, {"lessThan": "5d5a625cbc854d4c4f68e4b16fcf6e682d9a9ed1", "status": "affected", "version": "15f02b91056253e8cdc592888f431da0731337b8", "versionType": "git"}, {"lessThan": "6cb79e6499228cfdbd4b3301371ce74d01cd2f80", "status": "affected", "version": "15f02b91056253e8cdc592888f431da0731337b8", "versionType": "git"}, {"lessThan": "4ef05db5b08b176a551b4a6287372045998806b0", "status": "affected", "version": "15f02b91056253e8cdc592888f431da0731337b8", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/bluetooth/l2cap_core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.7"}, {"lessThan": "5.7", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.271", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.222", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.189", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.158", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.111", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.53", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan\n\nl2cap_new_connection() sets default value of channel mode to match the\nparent channel. l2cap_le_connect_req() left this at the default, and\ncreated L2CAP_MODE_EXT_FLOWCTL channels if listening pchan has that\nmode. This causes FLAG_DEFER_SETUP channels to reply to\nL2CAP_LE_CONN_REQ with L2CAP_ECRED_CONN_RSP, which is incorrect.\n\nIt can also result to stack OOB write (of l2cap_alloc_cid determined\nvalues) in l2cap_ecred_rsp_defer(), as l2cap_le_connect_req() does not\nlimit maximum number of deferred channels or check for duplicate ident.\n\nFix by setting chan->mode correctly in l2cap_le_connect_req().\n\nAlso check channel mode in l2cap_ecred_rsp_defer(), and do WARN_ON_ONCE\ninstead of OOB write to make it less brittle."}], "id": "CVE-2026-98108", "lastModified": "2026-10-19T10:18:08.400", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-09-25T11:17:41.863", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0e1fc7cab95ad958e55d70a5dfaaea687c9c639f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1074bcc57f741223f9fa82ce6afe5c3d783e4d10"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4ef05db5b08b176a551b4a6287372045998806b0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/564ae0e05e598aa895b9dbd18cb7d6eb64752869"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5d5a625cbc854d4c4f68e4b16fcf6e682d9a9ed1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6cb79e6499228cfdbd4b3301371ce74d01cd2f80"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/aab17938998b29e75c3324763411aef3e300fc67"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ad0f44a3f1f688558ed876a0702bc2c82b0df689"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Undergoing Analysis"}

{"bugzilla": {"description": "kernel: Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan", "id": "2541364", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2541364"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nBluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan\nl2cap_new_connection() sets default value of channel mode to match the\nparent channel. l2cap_le_connect_req() left this at the default, and\ncreated L2CAP_MODE_EXT_FLOWCTL channels if listening pchan has that\nmode. This causes FLAG_DEFER_SETUP channels to reply to\nL2CAP_LE_CONN_REQ with L2CAP_ECRED_CONN_RSP, which is incorrect.\nIt can also result to stack OOB write (of l2cap_alloc_cid determined\nvalues) in l2cap_ecred_rsp_defer(), as l2cap_le_connect_req() does not\nlimit maximum number of deferred channels or check for duplicate ident.\nFix by setting chan->mode correctly in l2cap_le_connect_req().\nAlso check channel mode in l2cap_ecred_rsp_defer(), and do WARN_ON_ONCE\ninstead of OOB write to make it less brittle.", "A flaw was found in the Linux kernel's Bluetooth subsystem. When processing Bluetooth Low Energy connection requests in the Logical Link Control and Adaptation Protocol (L2CAP) layer, channel modes are incorrectly assigned during deferred connection handling. A nearby attacker within Bluetooth range could exploit this vulnerability by sending specially crafted connection requests to trigger an out-of-bounds write to stack memory. This issue primarily leads to a system crash and Denial of Service (DoS), or potentially arbitrary code execution."], "name": "CVE-2026-98108", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98108\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98108\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98108.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[15f02b91056253e8cdc592888f431da0731337b8,1074bcc57f741223f9fa82ce6afe5c3d783e4d10)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[15f02b91056253e8cdc592888f431da0731337b8,5d5a625cbc854d4c4f68e4b16fcf6e682d9a9ed1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[15f02b91056253e8cdc592888f431da0731337b8,6cb79e6499228cfdbd4b3301371ce74d01cd2f80)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[15f02b91056253e8cdc592888f431da0731337b8,4ef05db5b08b176a551b4a6287372045998806b0)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.7"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,5.7)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.111,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.53,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.7,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-25T13:00:12.378978+00:00", "updated": "2026-09-30T06:00:12.740343+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-787"]}