CVE-2026-53208

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig<br /> <br /> net/bluetooth/l2cap_core.c:l2cap_sig_channel() accepts BR/EDR<br /> signaling packets up to the channel MTU and dispatches each command<br /> without enforcing the signaling MTU (MTUsig). A Bluetooth BR/EDR peer<br /> within radio range can send a fixed-channel CID 0x0001 packet that is<br /> larger than MTUsig and contains many L2CAP_ECHO_REQ commands before<br /> pairing. In a real-radio stock-kernel run, one 681-byte signaling<br /> packet containing 168 zero-length ECHO_REQ commands made the target<br /> transmit 168 ECHO_RSP frames over about 220 ms.<br /> <br /> Impact: a Bluetooth BR/EDR peer within radio range, before pairing, can<br /> force 168 ECHO_RSP frames from one 681-byte fixed-channel signaling<br /> packet containing packed ECHO_REQ commands.<br /> <br /> Define Linux&amp;#39;s BR/EDR signaling MTU as the spec minimum of 48 bytes and<br /> reject any larger signaling packet with one L2CAP_COMMAND_REJECT_RSP<br /> carrying L2CAP_REJ_MTU_EXCEEDED before any command is dispatched.<br /> <br /> The Bluetooth Core spec wording for MTUExceeded says the reject<br /> identifier shall match the first request command in the packet, and<br /> that packets containing only responses shall be silently discarded.<br /> Linux intentionally deviates from that prescription: silently<br /> discarding desynchronizes the peer because the remote stack never<br /> learns its responses were dropped, and locating the first request<br /> command requires walking command headers past MTUsig, i.e. processing<br /> bytes from a packet we have already decided is too large to process.<br /> We therefore always emit one reject and use the identifier from the<br /> first command header, a single fixed-offset byte read.<br /> <br /> The unrestricted BR/EDR signaling parser and ECHO_REQ response path both<br /> trace to the initial git import; no later introducing commit is<br /> available for a Fixes tag.