---
id: CVE-2026-90088
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop

  rfcomm_apply_pn() accepts the MTU value from a remote PN (Parameter
  Negotiation) frame wi…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop

  rfcomm_apply_pn() accepts the MTU value from a remote PN (Parameter
  Negotiation) frame wi…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    e7c0aa45ae6c5a338661b23812bfcdef50bf3e96
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    cbc2962da99b6b89345267d3aa74b4b573340548
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    9b2e5f1928c99224345a9ed8c5dae5fc74964d6d
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    fc4851ff8dfb505e9a19efcc286712132bbd178d
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    f561e44261344adadf9d6a6dff31e3af9776d5c6
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    aeee917a4878af95f0c63e18c5f22eaf6299c7b8
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    3988cbb1be501dbff909a2ee024670e3c955a66d
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    44c98fd082eafd49d55a8a4077ff488175b2fe24
  - Linux 2.6.12
published: '2026-09-17'
updated: '2026-09-17'
sourceUpdated: '2026-09-17T17:16:59.880'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-90088'
references:
  - url: 'https://git.kernel.org/stable/c/3988cbb1be501dbff909a2ee024670e3c955a66d'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/44c98fd082eafd49d55a8a4077ff488175b2fe24'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/9b2e5f1928c99224345a9ed8c5dae5fc74964d6d'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/aeee917a4878af95f0c63e18c5f22eaf6299c7b8'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/cbc2962da99b6b89345267d3aa74b4b573340548'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/e7c0aa45ae6c5a338661b23812bfcdef50bf3e96'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/f561e44261344adadf9d6a6dff31e3af9776d5c6'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/fc4851ff8dfb505e9a19efcc286712132bbd178d'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-17T16:21:47.893Z'
epss: 0.00211
epssPercentile: 0.10202
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop

rfcomm_apply_pn() accepts the MTU value from a remote PN (Parameter
Negotiation) frame without checking for zero. When the remote peer
sends an MTU of zero, d->mtu is set to 0. This causes the sendmsg
path to enter an infinite loop when fragmenting data, as each fragment
has size == min_t(size_t, len, 0) == 0, so the remaining length never
decreases. The infinite allocation of zero-length skbs exhausts all
system memory.

Fix by clamping d->mtu to RFCOMM_DEFAULT_MTU when the negotiated
value is zero, consistent with the initial value assigned in
rfcomm_dlc_alloc().

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.