CVE-2026-53254

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description RFCOMM MCC handlers cast skb->data to protocol-specific structs without first validating skb->len. This allows a malicious remote device to send truncated MCC frames, triggering out-of-bounds reads. The rfcomm recv rpn() function is specifically affected, as it must handle 1-byte RPN requests according to ETSI TS 07.10 by validating the DLCI byte first and the full struct only when the length is greater than 1.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.