CVE-2026-97408
Last modified
CVE-2026-97408 is a vulnerability of currently unknown severity. In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: validate connectionless PSM length Connectionless L2CAP frames carry a two-byte PSM at the start of the payload. l2cap_recv_frame() currently reads that PSM unconditionally after validating only the outer L2CAP length. A malformed connectionless frame with a zero- or one-byte payload can therefore make the parser read beyond the advertised skb payload and use tailroom bytes as part of the PSM.
Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: validate connectionless PSM length Connectionless L2CAP frames carry a two-byte PSM at the start of the payload. l2cap_recv_frame() currently reads that PSM unconditionally after validating only the outer L2CAP length. A malformed connectionless frame with a zero- or one-byte payload can therefore make the parser read beyond the advertised skb payload and use tailroom bytes as part of the PSM. A VHCI-backed QEMU reproducer injected a one-byte connectionless payload and reached the unchecked read. Reject connectionless frames that cannot contain the PSM before reading or pulling it. This preserves all valid connectionless frames while dropping only structurally incomplete packets.
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux | >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 3502ede8aed3c3ee1786d952a11054ac737d1a38; >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < ae69dca122f6d6046a68cf40153e6e827c77ff5c; >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < a40a5f922546b3bd7c094d882b29177db4f2abe0 |
| Linux | Linux | 2.6.12 |
References
Timeline
- Published
- Last Modified
- Status
- Received
Frequently Asked Questions
What is CVE-2026-97408?
How severe is CVE-2026-97408?
How do I fix CVE-2026-97408?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-9738The Print, PDF, Email by PrintFriendly plugin for WordPress …4.4
- CVE-2026-97387Rejected reason: This CVE is a duplicate of another CVE.
- CVE-2026-9739Vulnerable to DNS rebinding attacks when using SSE (http://b…9.4
- CVE-2026-9740A vulnerability in MongoDB Server's BSON validation logic al…8.7
- CVE-2026-97404In OpenStack Zaqar before 22.0.2, WSGI transport mishandles …9.2
- CVE-2026-97407In the Linux kernel, the following vulnerability has been re…
- CVE-2026-97409In the Linux kernel, the following vulnerability has been re…8.8
- CVE-2026-9741A bug in query analysis processing of the $vectorSearch aggr…7.1
- CVE-2026-97410In the Linux kernel, the following vulnerability has been re…
- CVE-2026-97411In the Linux kernel, the following vulnerability has been re…
- CVE-2026-97412In the Linux kernel, the following vulnerability has been re…
- CVE-2026-97413In the Linux kernel, the following vulnerability has been re…9.8
Are you affected by CVE-2026-97408?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST