Out-of-bounds Read Vulnerability in Linux Kernel Bluetooth RFCOMM Handler

CVE-2026-53254

What is CVE-2026-53254?

A vulnerability exists in the Bluetooth functionality of the Linux kernel, specifically within the RFCOMM MCC handlers. This flaw arises from the failure to validate the length of incoming data packets (skb->len) prior to processing. An attacker using a malicious remote device can send truncated MCC frames, leading to out-of-bounds reads. To mitigate this risk, the implementation has been updated to ensure proper length verification through skb_pull_data() before any dereferencing occurs. Special consideration is given to the rfcomm_recv_rpn() function, which will validate the DLCI byte initially, and only perform comprehensive structure validation if the length exceeds one byte.

References