CVE-2026-90088

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop rfcomm_apply_pn() accepts the MTU value from a remote PN (Parameter Negotiation) frame without checking for zero. When the remote peer sends an MTU of zero, d->mtu is set to 0. This causes the sendmsg path to enter an infinite loop when fragmenting data, as each fragment has size == min_t(size_t, len, 0) == 0, so the remaining length never decreases. The infinite allocation of zero-length skbs exhausts all system memory. Fix by clamping d->mtu to RFCOMM_DEFAULT_MTU when the negotiated value is zero, consistent with the initial value assigned in rfcomm_dlc_alloc().

CVSS

No CVSS.

References

Link	Resource
https://git.kernel.org/stable/c/3988cbb1be501dbff909a2ee024670e3c955a66d
https://git.kernel.org/stable/c/44c98fd082eafd49d55a8a4077ff488175b2fe24
https://git.kernel.org/stable/c/9b2e5f1928c99224345a9ed8c5dae5fc74964d6d
https://git.kernel.org/stable/c/aeee917a4878af95f0c63e18c5f22eaf6299c7b8
https://git.kernel.org/stable/c/cbc2962da99b6b89345267d3aa74b4b573340548
https://git.kernel.org/stable/c/e7c0aa45ae6c5a338661b23812bfcdef50bf3e96
https://git.kernel.org/stable/c/f561e44261344adadf9d6a6dff31e3af9776d5c6
https://git.kernel.org/stable/c/fc4851ff8dfb505e9a19efcc286712132bbd178d

Configurations

No configuration.

History

17 Sep 2026, 17:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-09-17 17:16

Updated : 2026-09-17 17:16

NVD link : CVE-2026-90088

Mitre link : CVE-2026-90088

CVE.ORG link : CVE-2026-90088

JSON object : View

Products Affected

No product.

CWE

No CWE.

{"id": "CVE-2026-90088", "cveTags": [], "metrics": {}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "e7c0aa45ae6c5a338661b23812bfcdef50bf3e96", "versionType": "git"}, {"status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "cbc2962da99b6b89345267d3aa74b4b573340548", "versionType": "git"}, {"status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "9b2e5f1928c99224345a9ed8c5dae5fc74964d6d", "versionType": "git"}, {"status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "fc4851ff8dfb505e9a19efcc286712132bbd178d", "versionType": "git"}, {"status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "f561e44261344adadf9d6a6dff31e3af9776d5c6", "versionType": "git"}, {"status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "aeee917a4878af95f0c63e18c5f22eaf6299c7b8", "versionType": "git"}, {"status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "3988cbb1be501dbff909a2ee024670e3c955a66d", "versionType": "git"}, {"status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "44c98fd082eafd49d55a8a4077ff488175b2fe24", "versionType": "git"}], "programFiles": ["net/bluetooth/rfcomm/core.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "2.6.12"}, {"status": "unaffected", "version": "0", "lessThan": "2.6.12", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.270", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.221", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.188", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.157", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.110", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.52", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.2.6", "versionType": "semver", "lessThanOrEqual": "7.2.*"}, {"status": "unaffected", "version": "7.3-rc1", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/bluetooth/rfcomm/core.c"], "defaultStatus": "affected"}]}], "published": "2026-09-17T17:16:59.880", "references": [{"url": "https://git.kernel.org/stable/c/3988cbb1be501dbff909a2ee024670e3c955a66d", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/44c98fd082eafd49d55a8a4077ff488175b2fe24", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/9b2e5f1928c99224345a9ed8c5dae5fc74964d6d", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/aeee917a4878af95f0c63e18c5f22eaf6299c7b8", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/cbc2962da99b6b89345267d3aa74b4b573340548", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/e7c0aa45ae6c5a338661b23812bfcdef50bf3e96", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/f561e44261344adadf9d6a6dff31e3af9776d5c6", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/fc4851ff8dfb505e9a19efcc286712132bbd178d", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Received", "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop\n\nrfcomm_apply_pn() accepts the MTU value from a remote PN (Parameter\nNegotiation) frame without checking for zero. When the remote peer\nsends an MTU of zero, d->mtu is set to 0. This causes the sendmsg\npath to enter an infinite loop when fragmenting data, as each fragment\nhas size == min_t(size_t, len, 0) == 0, so the remaining length never\ndecreases. The infinite allocation of zero-length skbs exhausts all\nsystem memory.\n\nFix by clamping d->mtu to RFCOMM_DEFAULT_MTU when the negotiated\nvalue is zero, consistent with the initial value assigned in\nrfcomm_dlc_alloc()."}], "lastModified": "2026-09-17T17:16:59.880", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}