CVE-2026-93783

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the Bluetooth RFCOMM component where the rfcomm recv frame() function casts skb->data to struct rfcomm hdr and dereferences hdr->addr and hdr->ctrl without first validating skb->len. This lack of validation allows a truncated frame with a length smaller than the minimum header size to cause an out-of-bounds read of uninitialized memory. Furthermore, a zero-length frame can cause skb->len-- to underflow to UINT MAX, resulting in skb tail pointer() reading significantly past the buffer.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.