{"id":"CVE-2026-98108","state":"PUBLISHED","title":"Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan\n\nl2cap_new_connection() sets default value of channel mode to match the\nparent channel.  l2cap_le_connect_req() left this at the default, and\ncreated L2CAP_MODE_EXT_FLOWCTL channels if listening pchan has that\nmode.  This causes FLAG_DEFER_SETUP channels to reply to\nL2CAP_LE_CONN_REQ with L2CAP_ECRED_CONN_RSP, which is incorrect.\n\nIt can also result to stack OOB write (of l2cap_alloc_cid determined\nvalues) in l2cap_ecred_rsp_defer(), as l2cap_le_connect_req() does not\nlimit maximum number of deferred channels or check for duplicate ident.\n\nFix by setting chan->mode correctly in l2cap_le_connect_req().\n\nAlso check channel mode in l2cap_ecred_rsp_defer(), and do WARN_ON_ONCE\ninstead of OOB write to make it less brittle.","publishedAt":"2026-09-25T10:35:56.935Z","updatedAt":"2026-10-19T09:14:00.739Z","severity":{"score":7.5,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"15f02b91056253e8cdc592888f431da0731337b8","status":"affected","lessThan":"ad0f44a3f1f688558ed876a0702bc2c82b0df689","versionType":"git"},{"version":"15f02b91056253e8cdc592888f431da0731337b8","status":"affected","lessThan":"564ae0e05e598aa895b9dbd18cb7d6eb64752869","versionType":"git"},{"version":"15f02b91056253e8cdc592888f431da0731337b8","status":"affected","lessThan":"aab17938998b29e75c3324763411aef3e300fc67","versionType":"git"},{"version":"15f02b91056253e8cdc592888f431da0731337b8","status":"affected","lessThan":"0e1fc7cab95ad958e55d70a5dfaaea687c9c639f","versionType":"git"},{"version":"15f02b91056253e8cdc592888f431da0731337b8","status":"affected","lessThan":"1074bcc57f741223f9fa82ce6afe5c3d783e4d10","versionType":"git"},{"version":"15f02b91056253e8cdc592888f431da0731337b8","status":"affected","lessThan":"5d5a625cbc854d4c4f68e4b16fcf6e682d9a9ed1","versionType":"git"},{"version":"15f02b91056253e8cdc592888f431da0731337b8","status":"affected","lessThan":"6cb79e6499228cfdbd4b3301371ce74d01cd2f80","versionType":"git"},{"version":"15f02b91056253e8cdc592888f431da0731337b8","status":"affected","lessThan":"4ef05db5b08b176a551b4a6287372045998806b0","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/bluetooth/l2cap_core.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.7","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.7","versionType":"semver"},{"version":"5.10.271","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.222","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.189","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.158","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.111","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.53","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.2.7","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/bluetooth/l2cap_core.c"]}],"references":["https://git.kernel.org/stable/c/ad0f44a3f1f688558ed876a0702bc2c82b0df689","https://git.kernel.org/stable/c/564ae0e05e598aa895b9dbd18cb7d6eb64752869","https://git.kernel.org/stable/c/aab17938998b29e75c3324763411aef3e300fc67","https://git.kernel.org/stable/c/0e1fc7cab95ad958e55d70a5dfaaea687c9c639f","https://git.kernel.org/stable/c/1074bcc57f741223f9fa82ce6afe5c3d783e4d10","https://git.kernel.org/stable/c/5d5a625cbc854d4c4f68e4b16fcf6e682d9a9ed1","https://git.kernel.org/stable/c/6cb79e6499228cfdbd4b3301371ce74d01cd2f80","https://git.kernel.org/stable/c/4ef05db5b08b176a551b4a6287372045998806b0"],"weaknesses":[],"ingestedAt":"2026-10-29T20:13:43.249Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/98xxx/CVE-2026-98108.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-98108","state":"PUBLISHED","datePublished":"2026-09-25T10:35:56.935Z","dateUpdated":"2026-10-19T09:14:00.739Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-09-25T10:25:14.316Z"},"containers":{"cna":{"title":"Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan\n\nl2cap_new_connection() sets default value of channel mode to match the\nparent channel.  l2cap_le_connect_req() left this at the default, and\ncreated L2CAP_MODE_EXT_FLOWCTL channels if listening pchan has that\nmode.  This causes FLAG_DEFER_SETUP channels to reply to\nL2CAP_LE_CONN_REQ with L2CAP_ECRED_CONN_RSP, which is incorrect.\n\nIt can also result to stack OOB write (of l2cap_alloc_cid determined\nvalues) in l2cap_ecred_rsp_defer(), as l2cap_le_connect_req() does not\nlimit maximum number of deferred channels or check for duplicate ident.\n\nFix by setting chan->mode correctly in l2cap_le_connect_req().\n\nAlso check channel mode in l2cap_ecred_rsp_defer(), and do WARN_ON_ONCE\ninstead of OOB write to make it less brittle."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"15f02b91056253e8cdc592888f431da0731337b8","status":"affected","lessThan":"ad0f44a3f1f688558ed876a0702bc2c82b0df689","versionType":"git"},{"version":"15f02b91056253e8cdc592888f431da0731337b8","status":"affected","lessThan":"564ae0e05e598aa895b9dbd18cb7d6eb64752869","versionType":"git"},{"version":"15f02b91056253e8cdc592888f431da0731337b8","status":"affected","lessThan":"aab17938998b29e75c3324763411aef3e300fc67","versionType":"git"},{"version":"15f02b91056253e8cdc592888f431da0731337b8","status":"affected","lessThan":"0e1fc7cab95ad958e55d70a5dfaaea687c9c639f","versionType":"git"},{"version":"15f02b91056253e8cdc592888f431da0731337b8","status":"affected","lessThan":"1074bcc57f741223f9fa82ce6afe5c3d783e4d10","versionType":"git"},{"version":"15f02b91056253e8cdc592888f431da0731337b8","status":"affected","lessThan":"5d5a625cbc854d4c4f68e4b16fcf6e682d9a9ed1","versionType":"git"},{"version":"15f02b91056253e8cdc592888f431da0731337b8","status":"affected","lessThan":"6cb79e6499228cfdbd4b3301371ce74d01cd2f80","versionType":"git"},{"version":"15f02b91056253e8cdc592888f431da0731337b8","status":"affected","lessThan":"4ef05db5b08b176a551b4a6287372045998806b0","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/bluetooth/l2cap_core.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.7","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.7","versionType":"semver"},{"version":"5.10.271","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.222","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.189","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.158","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.111","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.53","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.2.7","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/bluetooth/l2cap_core.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/ad0f44a3f1f688558ed876a0702bc2c82b0df689"},{"url":"https://git.kernel.org/stable/c/564ae0e05e598aa895b9dbd18cb7d6eb64752869"},{"url":"https://git.kernel.org/stable/c/aab17938998b29e75c3324763411aef3e300fc67"},{"url":"https://git.kernel.org/stable/c/0e1fc7cab95ad958e55d70a5dfaaea687c9c639f"},{"url":"https://git.kernel.org/stable/c/1074bcc57f741223f9fa82ce6afe5c3d783e4d10"},{"url":"https://git.kernel.org/stable/c/5d5a625cbc854d4c4f68e4b16fcf6e682d9a9ed1"},{"url":"https://git.kernel.org/stable/c/6cb79e6499228cfdbd4b3301371ce74d01cd2f80"},{"url":"https://git.kernel.org/stable/c/4ef05db5b08b176a551b4a6287372045998806b0"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:A - The malformed input is a series of L2CAP_LE_CONN_REQ signalling commands, all using the same ident, sent over a BLE link to l2cap_le_connect_req(). The attacker must be within Bluetooth radio range, so the vector is Adjacent.\nAC:H - The OOB write only happens if the target runs an LE listener in BT_MODE_EXT_FLOWCTL with DEFER_SETUP, whose children inherit EXT_FLOWCTL through l2cap_new_connection(). The attacker cannot create that listener. Once it exists, the attacker controls how many LE_CONN_REQs share one ident, and the service's own recvmsg() triggers the write.\nPR:N - l2cap_le_connect_req() only checks the listener's sec_level through smp_sufficient_security(). An LE listener defaults to BT_SECURITY_LOW, so an unpaired peer can open the channels, and Just Works pairing is available otherwise.\nUI:N - No human action is needed. The listening service's normal accept/recvmsg on a deferred child calls l2cap_sock_recvmsg(), which then calls __l2cap_ecred_conn_rsp_defer().\nS:U - The memory corruption stays within the kernel's own security authority. No VM or hardware isolation boundary is crossed.\nC:H - l2cap_ecred_rsp_defer() writes CIDs past the 5-entry scid[] into the adjacent 'count' field, which then steers later writes to attacker-influenced offsets on the kernel stack. Corruption of this kind can be leveraged for disclosure.\nI:H - This is an out-of-bounds write on the kernel stack in __l2cap_ecred_conn_rsp_defer(). The written values are l2cap_alloc_cid() CIDs whose count and order the attacker influences, and the write can reach the saved frame state.\nA:H - Stack corruption in __l2cap_ecred_conn_rsp_defer() causes a stack-protector panic or an oops, crashing the kernel, and the peer can repeat it."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-10-19T09:14:00.739Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.7","versionEndExcluding":"5.10.271"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.7","versionEndExcluding":"5.15.222"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.7","versionEndExcluding":"6.1.189"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.7","versionEndExcluding":"6.6.158"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.7","versionEndExcluding":"6.12.111"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.7","versionEndExcluding":"6.18.53"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.7","versionEndExcluding":"7.2.7"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.7","versionEndExcluding":"7.3"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}