CVE-2026-15460
Publiée le 2026-09-09 · Dernière modification le 2026-09-10
Les systèmes Linux utilisant le Bluetooth Classic sont affectés par une faille dans la manière dont le noyau gère les données entrantes lors de la phase de connexion. Un attaquant situé à portée radio peut envoyer des paquets spécialement conçus à un appareil avant que la connexion ne soit totalement établie ou authentifiée, ce qui pourrait provoquer un plantage du système ou une manipulation de la mémoire interne. Cette attaque ne nécessite aucune interaction de l'utilisateur ni d'authentification préalable, seulement la proximité physique avec l'appareil cible.
DÉTAIL DU VECTEUR CVSS
RÉFÉRENCES
Description officielle du NVD (en anglais)
The Bluetooth Classic (BR/EDR) L2CAP receive handler bt_l2cap_br_recv() in subsys/bluetooth/host/classic/l2cap_br.c dispatched inbound data PDUs based only on the destination channel ID, without checking that the target channel had reached the BT_L2CAP_CONNECTED state. A dynamic channel is assigned its RX CID and added to the connection's channel list while still in BT_L2CAP_CONNECTING (and later BT_L2CAP_CONFIG) — before configuration completes and, for PSMs that require security, before the peer is authenticated (l2cap_br_conn_req()). Because the channel is already findable by bt_l2cap_br_lookup_rx_cid() during this window, a remote peer within radio range can send a data PDU addressed to that CID and have it processed on a not-yet-established channel. The dispatch keys off channel fields (BR_CHAN(chan)->rx.mode, rx.mps) that are only initialized during configuration by l2cap_br_conf(); since channel objects are pooled and bt_l2cap_br_chan_del() does not reset rx.mode or the reassembly buffer _sdu, a reused channel can carry stale state into the CONNECTING window and route the frame into the retransmission/flow-control path (bt_l2cap_br_ret_fc_recv()) with stale parameters and a possibly stale _sdu pointer. The impact is delivery of attacker data to upper-layer protocol handlers on a half-open (and possibly unauthenticated) channel, plus operation on stale or partially initialized channel state on reused channel objects — leading to channel/link teardown (denial of service) and, in the stale-_sdu case, a dangling-pointer condition. The fix adds an explicit BR_CHAN(chan)->state < BT_L2CAP_CONNECTED guard that drops any data received before the channel is fully connected.