CVE-2026-53253: Linux Kernel Bluetooth BNEP Out-of-Bounds Read DoS Vulnerability

Technical summary

CVE-2026-53253 is an out-of-bounds read vulnerability (CWE-125) in the Linux kernel's net/bluetooth/bnep/core.c module, specifically in the bnep_rx_frame() function. The vulnerability occurs because the BNEP frame parser dereferences packet fields—including the packet type byte, control opcode, and setup UUID-size byte—without first validating that sufficient data exists in the socket buffer (skb). The kernel report indicates a KASAN slab-out-of-bounds detection where a 1-byte read was attempted beyond the allocated region. The fix involves using skb_pull_data() to safely extract fixed-size fields, ensuring a NULL return gates each subsequent dereference, and refactoring the control handler to document explicit UUID tuple parsing for BNEP_SETUP_CONN_REQ frames.

Business impact

This vulnerability can cause denial of service on systems running vulnerable Linux kernels with active Bluetooth BNEP processing. A local or proximate attacker with Bluetooth radio range can send a crafted BNEP frame to crash the kernel or trigger an unexpected shutdown. On embedded devices, IoT systems, or servers providing Bluetooth connectivity, this can interrupt service availability. The HIGH severity rating reflects the combination of local/adjacent network access with high availability impact. Information disclosure is a secondary concern if memory contents leak before the crash occurs.

Affected systems

The vulnerability affects Linux kernel installations with Bluetooth BNEP support enabled. This includes most mainstream Linux distributions when Bluetooth is active, as well as embedded systems and IoT devices running Linux with Bluetooth connectivity. The vulnerability does not require a user account or elevated privileges on the target system; a Bluetooth peer within radio range can initiate the attack. Patch status and affected kernel versions should be verified against the vendor advisory, as the CVE entry covers multiple kernel release lines.

Exploitability

Exploitation requires proximity: the attacker must be within Bluetooth radio range (typically 10–100 meters depending on device class) of the target system. No user interaction or authentication is required. The attack is straightforward—sending a malformed BNEP frame—and does not depend on complex timing or race conditions. The CVSS vector (AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H) confirms that the barrier to exploitation is low once proximity is achieved. This vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, but the simplicity of triggering an out-of-bounds read makes it a practical denial-of-service vector.

Remediation

Apply a Linux kernel update that includes the fix for CVE-2026-53253. The remedy involves patching the bnep_rx_frame() and bnep_rx_control() functions to use safe buffer-extraction primitives (skb_pull_data()) before dereferencing frame fields. Verify the patched kernel version against your distribution's security advisory. For systems where Bluetooth BNEP is not required, disabling the bnep kernel module (via modprobe blacklist or compile-time configuration) eliminates the attack surface entirely.

Patch guidance

Check your Linux distribution's security bulletin for the specific kernel version that addresses CVE-2026-53253. Most major distributions (Ubuntu, Red Hat, Debian, SUSE, etc.) will release patches through their standard update channels. Apply kernel updates at your next maintenance window, or sooner if the system is exposed to untrusted Bluetooth peers. Verify the patched kernel version matches or exceeds the version specified in your vendor advisory. If BNEP functionality is not used, consider disabling the bnep module to reduce attack surface while patches are being prepared.

Detection guidance

Monitor kernel logs for KASAN reports containing 'bnep_rx_frame' or slab-out-of-bounds warnings related to Bluetooth processing. Unexpected kernel panics or watchdog reboots on systems with active Bluetooth connectivity may indicate exploitation attempts. Behavioral detection is limited; the crash itself is the primary signal. On systems with Bluetooth monitoring in place, correlate unexpected BNEP frame anomalies with kernel errors. If feasible, use system call tracing or eBPF-based monitoring to detect malformed Bluetooth frames before they reach the vulnerable code path, though this requires specialized instrumentation.

Why prioritize this

Prioritize this vulnerability for systems with active Bluetooth BNEP connectivity, particularly IoT devices, embedded appliances, and servers in environments where Bluetooth peers may be untrusted. The HIGH severity score, combined with the ease of triggering a denial-of-service condition from adjacent network access, warrants prompt patching. Systems in closed environments with controlled Bluetooth pairing can defer patching slightly, but should not delay indefinitely. The lack of KEV designation does not diminish the practical risk in real-world Bluetooth deployments.

Risk score, explained

The CVSS v3.1 score of 7.1 (HIGH) reflects a high-impact denial-of-service vulnerability with low complexity and no privilege or user-interaction requirements. The Attack Vector of Adjacent (AV:A) acknowledges that Bluetooth requires proximity but not network-wide reachability. The high Availability impact (A:H) dominates the score, as kernel crashes directly disrupt service. Confidentiality is rated Low (C:L) because some memory contents may leak before the crash, but this is not the primary concern. Integrity is Not affected (I:N) because the vulnerability does not allow data modification or privilege escalation.

Frequently asked questions