CVE-2026-98107

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: L2CAP: fix out-of-bounds write in l2cap_ecred_connect

l2cap_chan_connect() tries to ensure there are no more than

L2CAP_ECRED_CONN_SCID_MAX pending ECRED channels, so they fit in the

same L2CAP_ECRED_CONN_REQ that l2cap_ecred_connect() constructs.

However, the check only counts deferred channels. If 6 L2CAP sockets

are connected at the same time in order DDDDND (D=deferred,

N=non-deferred), the last can bump the total to max+1. It results to

one __le16 written out of bounds of the scid array, and an invalid

ECRED_CONN_REQ being sent.

Fix by leaving room for the non-deferred pending ECRED channels in the

counting in l2cap_chan_connect(), so the limit can't be exceeded.

Move counting under same critical section where the channel is added.

Although race conditions involving this appear unreachable, it's easier

to see.

Also add WARN_ON_ONCE check in l2cap_ecred_defer_connect() to make this

less brittle.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References