---
id: CVE-2026-98108
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan

  l2cap_new_connection() sets default value of channel mode to match the
  parent channel
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan

  l2cap_new_connection() sets default value of channel mode to match the
  parent channel.  l2cap_le_co…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 15f02b91056253e8cdc592888f431da0731337b8 <
    1074bcc57f741223f9fa82ce6afe5c3d783e4d10
  - >-
    Linux >= 15f02b91056253e8cdc592888f431da0731337b8 <
    5d5a625cbc854d4c4f68e4b16fcf6e682d9a9ed1
  - >-
    Linux >= 15f02b91056253e8cdc592888f431da0731337b8 <
    6cb79e6499228cfdbd4b3301371ce74d01cd2f80
  - >-
    Linux >= 15f02b91056253e8cdc592888f431da0731337b8 <
    4ef05db5b08b176a551b4a6287372045998806b0
  - Linux 5.7
published: '2026-09-25'
updated: '2026-09-25'
sourceUpdated: '2026-09-25T15:18:05.950'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-98108'
references:
  - url: 'https://git.kernel.org/stable/c/1074bcc57f741223f9fa82ce6afe5c3d783e4d10'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/4ef05db5b08b176a551b4a6287372045998806b0'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/5d5a625cbc854d4c4f68e4b16fcf6e682d9a9ed1'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/6cb79e6499228cfdbd4b3301371ce74d01cd2f80'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-25T11:06:38.825Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan

l2cap_new_connection() sets default value of channel mode to match the
parent channel.  l2cap_le_connect_req() left this at the default, and
created L2CAP_MODE_EXT_FLOWCTL channels if listening pchan has that
mode.  This causes FLAG_DEFER_SETUP channels to reply to
L2CAP_LE_CONN_REQ with L2CAP_ECRED_CONN_RSP, which is incorrect.

It can also result to stack OOB write (of l2cap_alloc_cid determined
values) in l2cap_ecred_rsp_defer(), as l2cap_le_connect_req() does not
limit maximum number of deferred channels or check for duplicate ident.

Fix by setting chan->mode correctly in l2cap_le_connect_req().

Also check channel mode in l2cap_ecred_rsp_defer(), and do WARN_ON_ONCE
instead of OOB write to make it less brittle.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.