CVE-2026-53253

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: bnep: reject short frames before parsing

A BNEP peer can send a short BNEP SDU. bnep_rx_frame() reads the

packet type byte immediately and, for control packets, reads the control

opcode and setup UUID-size byte before proving that those bytes are

present. bnep_rx_control() also dereferences the control opcode without

rejecting an empty control payload.

Use skb_pull_data() for the fixed fields in bnep_rx_frame() so a NULL

return gates each dereference. Split the control handler so the frame

path can pass an opcode that has already been pulled, and keep the

byte-buffer wrapper for extension control payloads.

For BNEP_SETUP_CONN_REQ, name the UUID-size byte before pulling the

setup payload. struct bnep_setup_conn_req carries destination and source

service UUIDs after that byte, each uuid_size bytes, so the parser now

documents that tuple explicitly instead of leaving the pull length as an

opaque multiplicat

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References