important · Bluetooth
A connected Bluetooth peer can make Linux L2CAP read beyond its logical packet boundary.
Affects
Linux kernel Bluetooth hosts with L2CAP channels using Enhanced Retransmission or streaming mode.
A short ERTM or streaming frame reaches missing minimum-length checks before the control field or optional FCS is read. Pairing requirements depend on the exposed service, and no public stock-host reproduction establishes a crash, disclosure or other observable consequence.
Detail and 2 sources
Chain to watch
Establish an ERTM or streaming-mode L2CAP channel→↓Send a frame shorter than the negotiated control-field and FCS requirements→↓Linux reads beyond the logical skb boundary→↓No public reproduction establishes a crash, information disclosure or other attacker-observable consequence on a stock host.
Unverified chainReplay truncated ERTM and streaming frames through a real controller against KASAN and hardened distribution kernels, recording whether the values affect parsing, disclosure or availability.