CVE-2026-90088

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the Bluetooth RFCOMM component where the rfcomm apply pn() function accepts a Maximum Transmission Unit (MTU) value from a remote Parameter Negotiation (PN) frame without verifying if the value is zero. If a remote peer provides an MTU of zero, the d->mtu variable is set to 0, causing the sendmsg path to enter an infinite loop during data fragmentation. This occurs because each fragment size is calculated as zero, preventing the remaining length from decreasing and leading to the infinite allocation of zero-length socket buffers (skbs), which exhausts system memory.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.