In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: RFCOMM: validate skb length in MCC handlers

The RFCOMM MCC handlers cast skb->data to protocol-specific structs
without validating skb->len first. A malicious remote device can send
truncated MCC frames and trigger out-of-bounds reads in these handlers.

Fix this by using skb_pull_data() to validate and access the required
data before dereferencing it.

rfcomm_recv_rpn() requires special handling since ETSI TS 07.10 allows
1-byte RPN requests. Handle this by validating only the DLCI byte first,
and validating the full struct only when len > 1.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0018.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 affected < 7c15c7c2878957cbfed93bcc29c13fdace464254
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 affected < 0d637136ce89f9a2309b2c3502402ce400dab0ef
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 affected < 98377e6b1a1a56561ec66a181573ea2b61b2079e
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 affected < 1b070ac9e99c2c2c3a8112943ca98ab6fca7f10c
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 affected < 3eabc6d47a0ad22b053329997aaf0ec1e581e392
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 affected < 08b9c1fbe78f4ad3f6250c6541cfaabdbeb81997
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 affected < 23882b828c3c8c51d0c946446a396b10abb3b16b
Linux Linux affected
Version Status Constraints
2.6.12 affected —
0 unaffected < 2.6.12
5.15.210 unaffected ≤ 5.15.*
6.1.176 unaffected ≤ 6.1.*
6.6.143 unaffected ≤ 6.6.*
6.12.94 unaffected ≤ 6.12.*
6.18.36 unaffected ≤ 6.18.*
7.0.13 unaffected ≤ 7.0.*
7.1 unaffected ≤ *

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/08b9c1fbe78f4ad3f6250c6541cfaabdbeb81997 cve-icon
https://git.kernel.org/stable/c/0d637136ce89f9a2309b2c3502402ce400dab0ef cve-icon
https://git.kernel.org/stable/c/1b070ac9e99c2c2c3a8112943ca98ab6fca7f10c cve-icon
https://git.kernel.org/stable/c/23882b828c3c8c51d0c946446a396b10abb3b16b cve-icon
https://git.kernel.org/stable/c/3eabc6d47a0ad22b053329997aaf0ec1e581e392 cve-icon
https://git.kernel.org/stable/c/7c15c7c2878957cbfed93bcc29c13fdace464254 cve-icon
https://git.kernel.org/stable/c/98377e6b1a1a56561ec66a181573ea2b61b2079e cve-icon
History

Thu, 25 Jun 2026 12:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-119
CWE-125

Thu, 25 Jun 2026 09:15:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: validate skb length in MCC handlers The RFCOMM MCC handlers cast skb->data to protocol-specific structs without validating skb->len first. A malicious remote device can send truncated MCC frames and trigger out-of-bounds reads in these handlers. Fix this by using skb_pull_data() to validate and access the required data before dereferencing it. rfcomm_recv_rpn() requires special handling since ETSI TS 07.10 allows 1-byte RPN requests. Handle this by validating only the DLCI byte first, and validating the full struct only when len > 1.
Title Bluetooth: RFCOMM: validate skb length in MCC handlers
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-06-25T08:39:45.273Z

Reserved: 2026-06-09T07:44:35.394Z

Link: CVE-2026-53254

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-25T12:15:03Z

Weaknesses