CVE-2026-98602

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough

Fix multiple out-of-bounds reads in Bluetooth BNEP frame processing:

1. In bnep_rx_frame() and bnep_ctrl_frame() (net/bluetooth/bnep/core.c),

use pskb_may_pull() to verify the BNEP header, control type byte,

filter count, and extension headers exist before reading them, and

return 0 after handling BNEP_CONTROL instead of falling through to

Ethernet frame submission when no extension headers follow.

2. In bnep_net_xmit() (net/bluetooth/bnep/netdev.c), verify skb->len >=

ETH_HLEN with pskb_may_pull() before reading the 14-byte Ethernet

header to prevent an out-of-bounds heap read and infoleak on short

AF_PACKET TX frames.