GHSA-J6JV-MCF5-3925
Vulnerability from github – Published: 2026-09-17 18:31 – Updated: 2026-09-17 18:31In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop
rfcomm_apply_pn() accepts the MTU value from a remote PN (Parameter Negotiation) frame without checking for zero. When the remote peer sends an MTU of zero, d->mtu is set to 0. This causes the sendmsg path to enter an infinite loop when fragmenting data, as each fragment has size == min_t(size_t, len, 0) == 0, so the remaining length never decreases. The infinite allocation of zero-length skbs exhausts all system memory.
Fix by clamping d->mtu to RFCOMM_DEFAULT_MTU when the negotiated value is zero, consistent with the initial value assigned in rfcomm_dlc_alloc().
{
"affected": [],
"aliases": [
"CVE-2026-90088"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-17T17:16:59Z",
"severity": null
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop\n\nrfcomm_apply_pn() accepts the MTU value from a remote PN (Parameter\nNegotiation) frame without checking for zero. When the remote peer\nsends an MTU of zero, d-\u003emtu is set to 0. This causes the sendmsg\npath to enter an infinite loop when fragmenting data, as each fragment\nhas size == min_t(size_t, len, 0) == 0, so the remaining length never\ndecreases. The infinite allocation of zero-length skbs exhausts all\nsystem memory.\n\nFix by clamping d-\u003emtu to RFCOMM_DEFAULT_MTU when the negotiated\nvalue is zero, consistent with the initial value assigned in\nrfcomm_dlc_alloc().",
"id": "GHSA-j6jv-mcf5-3925",
"modified": "2026-09-17T18:31:50Z",
"published": "2026-09-17T18:31:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90088"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/3988cbb1be501dbff909a2ee024670e3c955a66d"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/44c98fd082eafd49d55a8a4077ff488175b2fe24"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/9b2e5f1928c99224345a9ed8c5dae5fc74964d6d"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/aeee917a4878af95f0c63e18c5f22eaf6299c7b8"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/cbc2962da99b6b89345267d3aa74b4b573340548"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/e7c0aa45ae6c5a338661b23812bfcdef50bf3e96"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/f561e44261344adadf9d6a6dff31e3af9776d5c6"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/fc4851ff8dfb505e9a19efcc286712132bbd178d"
}
],
"schema_version": "1.4.0",
"severity": []
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.