CVE-2026-53254

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: validate skb length in MCC handlers The RFCOMM MCC handlers cast skb->data to protocol-specific structs without validating skb->len first. A malicious remote device can send truncated MCC frames and trigger out-of-bounds reads in these handlers. Fix this by using skb_pull_data() to validate and access the required data before dereferencing it. rfcomm_recv_rpn() requires special handling since ETSI TS 07.10 allows 1-byte RPN requests. Handle this by validating only the DLCI byte first, and validating the full struct only when len > 1.

CVSS v3.1 Score

8.1

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

EPSS — Exploit Prediction

0.0028

Probability of exploitation

0.20%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

References

Other References

https://git.kernel.org/stable/c/08b9c1fbe78f4ad3f6250c6541cfaabdbeb81997 https://git.kernel.org/stable/c/0d637136ce89f9a2309b2c3502402ce400dab0ef https://git.kernel.org/stable/c/1b070ac9e99c2c2c3a8112943ca98ab6fca7f10c https://git.kernel.org/stable/c/23882b828c3c8c51d0c946446a396b10abb3b16b https://git.kernel.org/stable/c/3eabc6d47a0ad22b053329997aaf0ec1e581e392 https://git.kernel.org/stable/c/7c15c7c2878957cbfed93bcc29c13fdace464254 https://git.kernel.org/stable/c/98377e6b1a1a56561ec66a181573ea2b61b2079e

Frequently Asked Questions

What is CVE-2026-53254? +

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: validate skb length in MCC handlers The RFCOMM MCC handlers cast skb->data to protocol-specific structs without validating skb->len first. A malicious remote device can send truncated MCC frames and trigger out-of-bounds reads in these handlers. Fix this by using skb_pull_data() to validate and access the required data before dereferencing it. rfcomm_recv_rpn() requires special handling since ETSI TS 07.10 allows 1-byte RPN requests. Handle this by validating only the DLCI byte first, and validating the full struct only when len > 1. It has a CVSS v3.1 base score of 8.1 (HIGH).

How severe is CVE-2026-53254? +

CVE-2026-53254 has a CVSS v3.1 score of 8.1 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching. The EPSS score is 0.0028, placing it in the 0th percentile for exploitation probability.

How do I check if I'm vulnerable to CVE-2026-53254? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.