{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.113-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.2.9-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame()  While rfcomm_recv_frame() verifies that skb-\u003elen is at least sizeof(*hdr) + 1 (4 bytes: 3-byte header + 1-byte FCS), an RFCOMM frame with an extended 2-byte length field (!__test_ea(hdr-\u003elen)) has a 4-byte header plus a 1-byte FCS (5 bytes minimum, sizeof(*hdr) + 2).  When a 4-byte RFCOMM frame with EA == 0 arrives: 1. The initial skb-\u003elen \u003c sizeof(*hdr) + 1 check passes (4 \u003c 4 is false). 2. Trimming the FCS byte decrements skb-\u003elen to 3. 3. If __check_fcs() succeeds, skb_pull(skb, 4) fails (4 \u003e 3) and returns    NULL without advancing skb-\u003edata. 4. Because the return value of skb_pull() is ignored, the un-pulled    3-byte struct rfcomm_hdr remains at skb-\u003edata and is either queued as    application payload via rfcomm_recv_data() or parsed as a multiplexer    control command via rfcomm_recv_mcc() on DLCI 0.  Fix this by extending the length check in rfcomm_recv_frame() to also require skb-\u003elen \u003e= sizeof(*hdr) + 2 when !__test_ea(hdr-\u003elen).",
  "id": "DEBIAN-CVE-2026-98600",
  "modified": "2026-10-19T04:47:26.098737940Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-98600"
    }
  ],
  "upstream": [
    "CVE-2026-98600"
  ]
}