High 8.1Published Jun 25, 2026

CVE-2026-53254Bluetooth: RFCOMM: validate skb length in MCC handlers

Updated under an hour ago (Oct 27, 2026, 11:40 AM ET)

Does this affect you?

It affects Linux and 2 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: validate skb length in MCC handlers The RFCOMM MCC handlers cast skb->data to protocol-specific structs without validating skb->len first. A malicious remote device can send truncated MCC frames and trigger out-of-bounds reads in these handlers. Fix this by using skb_pull_data() to validate and access the required data before dereferencing it. rfcomm_recv_rpn() requires special handling since ETSI TS 07.10 allows 1-byte RPN requests. Handle this by validating only the DLCI byte first, and validating the full struct only when len > 1.

CVSS: 8.1 HIGH (v3.1, CNA)CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Weakness (CWE): CWE-125
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 7c15c7c2878957cbfed93bcc29c13fdace464254; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 builds before 0d637136ce89f9a2309b2c3502402ce400dab0ef; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 98377e6b1a1a56561ec66a181573ea2b61b2079e; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 builds before 1b070ac9e99c2c2c3a8112943ca98ab6fca7f10c; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 3eabc6d47a0ad22b053329997aaf0ec1e581e392; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 08b9c1fbe78f4ad3f6250c6541cfaabdbeb81997; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 23882b828c3c8c51d0c946446a396b10abb3b16b	CNA record
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem siemens:simatic_s7_1500_tm_mfp_gnu_linux_subsystem (from the name)	all versions	CISA ADP
linux linux_kernel linux:linux_kernel	from 2.6.12.1 before 5.15.210; from 5.16 before 6.1.176; from 6.2 before 6.6.143; from 6.7 before 6.12.94; from 6.13 before 6.18.36; from 6.19 before 7.0.13; 2.6.12; 2.6.12; and 9 more ranges	NVD

References

References

https://git.kernel.org/stable/c/7c15c7c2878957cbfed93bcc29c13fdace464254	patch
https://git.kernel.org/stable/c/0d637136ce89f9a2309b2c3502402ce400dab0ef	patch
https://git.kernel.org/stable/c/98377e6b1a1a56561ec66a181573ea2b61b2079e	patch
https://git.kernel.org/stable/c/1b070ac9e99c2c2c3a8112943ca98ab6fca7f10c	patch
https://git.kernel.org/stable/c/3eabc6d47a0ad22b053329997aaf0ec1e581e392	patch
https://git.kernel.org/stable/c/08b9c1fbe78f4ad3f6250c6541cfaabdbeb81997	patch
https://git.kernel.org/stable/c/23882b828c3c8c51d0c946446a396b10abb3b16b	patch
https://cert-portal.siemens.com/productcert/html/ssa-784472.html

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.