{"id":"AZL-103928","summary":"CVE-2026-93783 affecting package kernel 6.6.157.1-1","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: RFCOMM: validate skb length in rfcomm_recv_frame\n\nrfcomm_recv_frame() casts skb-\u003edata to struct rfcomm_hdr and dereferences\nhdr-\u003eaddr and hdr-\u003ectrl without validating skb-\u003elen first. A truncated\nframe with skb-\u003elen less than the minimum header size causes an\nout-of-bounds read of uninitialized memory. Additionally, a zero-length\nframe causes skb-\u003elen-- to underflow to UINT_MAX, making\nskb_tail_pointer() read far past the buffer.\n\nCommit 23882b828c3c (\"Bluetooth: RFCOMM: validate skb length in MCC\nhandlers\") fixed the same class of missing-length-check bugs in the MCC\nsub-handlers, but the top-level rfcomm_recv_frame() was left unfixed.\nKMSAN reports:\n\n  BUG: KMSAN: uninit-value in rfcomm_run\n  ...\n  Uninit was created at:\n    __alloc_skb+0x474/0xb60\n    vhci_write+0xe9/0x870\n\nFix this by rejecting frames smaller than sizeof(struct rfcomm_hdr) + 1\n(the minimum frame must have a 3-byte header and a 1-byte FCS).","modified":"2026-09-25T14:16:08.411136052Z","published":"2026-09-24T17:17:10Z","upstream":["CVE-2026-93783"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93783"}],"affected":[{"package":{"name":"kernel","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/kernel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.6.157.1-1"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-103928.json"}}],"schema_version":"1.9.0"}