CVE-2026-53253

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> Bluetooth: bnep: reject short frames before parsing<br /> <br /> A BNEP peer can send a short BNEP SDU. bnep_rx_frame() reads the<br /> packet type byte immediately and, for control packets, reads the control<br /> opcode and setup UUID-size byte before proving that those bytes are<br /> present. bnep_rx_control() also dereferences the control opcode without<br /> rejecting an empty control payload.<br /> <br /> Use skb_pull_data() for the fixed fields in bnep_rx_frame() so a NULL<br /> return gates each dereference. Split the control handler so the frame<br /> path can pass an opcode that has already been pulled, and keep the<br /> byte-buffer wrapper for extension control payloads.<br /> <br /> For BNEP_SETUP_CONN_REQ, name the UUID-size byte before pulling the<br /> setup payload. struct bnep_setup_conn_req carries destination and source<br /> service UUIDs after that byte, each uuid_size bytes, so the parser now<br /> documents that tuple explicitly instead of leaving the pull length as an<br /> opaque multiplication.<br /> <br /> Validation reproduced this kernel report:<br /> KASAN slab-out-of-bounds in bnep_rx_frame.isra.0+0x130c/0x1790<br /> The buggy address belongs to the object at ffff88800c0f7908 which belongs<br /> to the cache kmalloc-8 of size 8<br /> The buggy address is located 0 bytes to the right of allocated 1-byte<br /> region [ffff88800c0f7908, ffff88800c0f7909)<br /> Read of size 1<br /> Call trace:<br /> dump_stack_lvl+0xb3/0x140 (?:?)<br /> print_address_description+0x57/0x3a0 (?:?)<br /> bnep_rx_frame+0x130c/0x1790 (net/bluetooth/bnep/core.c:306)<br /> print_report+0xb9/0x2b0 (?:?)<br /> __virt_addr_valid+0x1ba/0x3a0 (?:?)<br /> srso_alias_return_thunk+0x5/0xfbef5 (?:?)<br /> kasan_addr_to_slab+0x21/0x60 (?:?)<br /> kasan_report+0xe0/0x110 (?:?)<br /> process_one_work+0xfce/0x17e0 (kernel/workqueue.c:3200)<br /> worker_thread+0x65c/0xe40 (?:?)<br /> __kthread_parkme+0x184/0x230 (?:?)<br /> kthread+0x35e/0x470 (?:?)<br /> _raw_spin_unlock_irq+0x28/0x50 (?:?)<br /> ret_from_fork+0x586/0x870 (?:?)<br /> __switch_to+0x74f/0xdc0 (?:?)<br /> ret_from_fork_asm+0x1a/0x30 (?:?)