CVE-2026-93783

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame<br /> <br /> rfcomm_recv_frame() casts skb-&gt;data to struct rfcomm_hdr and dereferences<br /> hdr-&gt;addr and hdr-&gt;ctrl without validating skb-&gt;len first. A truncated<br /> frame with skb-&gt;len less than the minimum header size causes an<br /> out-of-bounds read of uninitialized memory. Additionally, a zero-length<br /> frame causes skb-&gt;len-- to underflow to UINT_MAX, making<br /> skb_tail_pointer() read far past the buffer.<br /> <br /> Commit 23882b828c3c ("Bluetooth: RFCOMM: validate skb length in MCC<br /> handlers") fixed the same class of missing-length-check bugs in the MCC<br /> sub-handlers, but the top-level rfcomm_recv_frame() was left unfixed.<br /> KMSAN reports:<br /> <br /> BUG: KMSAN: uninit-value in rfcomm_run<br /> ...<br /> Uninit was created at:<br /> __alloc_skb+0x474/0xb60<br /> vhci_write+0xe9/0x870<br /> <br /> Fix this by rejecting frames smaller than sizeof(struct rfcomm_hdr) + 1<br /> (the minimum frame must have a 3-byte header and a 1-byte FCS).