In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix chan...
zetlyn/cve-ghsa vulnerability ghsa GHSA-q3c9-52vx-cgp8 cve CVE-2026-98108 known 2026-09-25
https://github.com/advisories/GHSA-q3c9-52vx-cgp8
Properties
| cvss | 7.5receipt
This source has not kept a receipt for this claim yet. The next update that reads it will. |
|---|---|
| severity | high From 7.0 to 8.9. receipt
This source has not kept a receipt for this claim yet. The next update that reads it will. |
Text
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: L2CAP: fix chan...
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan
l2cap_new_connection() sets default value of channel mode to match the
parent channel. l2cap_le_connect_req() left this at the default, and
created L2CAP_MODE_EXT_FLOWCTL channels if listening pchan has that
mode. This causes FLAG_DEFER_SETUP channels to reply to
L2CAP_LE_CONN_REQ with L2CAP_ECRED_CONN_RSP, which is incorrect.
It can also result to stack OOB write (of l2cap_alloc_cid determined
values) in l2cap_ecred_rsp_defer(), as l2cap_le_connect_req() does not
limit maximum number of deferred channels or check for duplicate ident.
Fix by setting chan->mode correctly in l2cap_le_connect_req().
Also check channel mode in l2cap_ecred_rsp_defer(), and do WARN_ON_ONCE
instead of OOB write to make it less brittle.