CVE-2026-98460

Received Received - Intake

Bluetooth OCF Filter Bypass in Linux Kernel

Publication date: 2026-10-18

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sock: reject out-of-range OCF values The raw HCI socket security filter has 128 OCF bits per supported OGF, but masks the 10-bit OCF with 127 before looking up the command. An unprivileged socket can therefore submit a reserved OCF that aliases an allowlisted command modulo 128. A conforming controller should reject reserved opcodes. Nevertheless, the security decision must apply to the opcode that will actually be sent, especially since controller-specific behavior is outside the host stack's control. Reject OCF values that cannot be represented by the security filter instead of aliasing them onto an unrelated command.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-18

EPSS Evaluated

N/A

NVD

CVE-2026-98460

EUVD

EUVD-2026-103700

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Linux	Linux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Linux	Linux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Linux	Linux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Linux	Linux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Linux	Linux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Linux	Linux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Linux	Linux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Linux	Linux	2.6.12

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves Bluetooth HCI sockets where the security filter incorrectly handles OCF values. The filter uses 128 bits for OCF but masks the 10-bit OCF with 127, allowing unprivileged sockets to submit reserved OCF values that alias to allowlisted commands. This could let unauthorized commands be processed as valid.

Detection Guidance

This vulnerability involves Bluetooth HCI socket security filters in the Linux kernel. Detection requires checking kernel versions and Bluetooth stack configurations. Inspect kernel logs for Bluetooth-related errors or unexpected OCF values. Use commands like 'dmesg | grep -i bluetooth' or 'journalctl -u bluetooth' to review logs. Verify if your kernel version includes the fix by checking 'uname -r' and comparing against patched versions.

Impact Analysis

An attacker could exploit this to send unauthorized Bluetooth commands through a vulnerable system, potentially gaining control or accessing sensitive data. Since it affects raw HCI sockets, it may allow privilege escalation or unauthorized device interactions.

Compliance Impact

This vulnerability does not directly impact compliance with GDPR or HIPAA as it is a low-level Bluetooth stack issue in the Linux kernel. It involves improper handling of Bluetooth command opcodes but does not expose or leak sensitive data, which is a key concern for these regulations.

Mitigation Strategies

Update your Linux kernel to the latest patched version to resolve this issue. If immediate patching is not possible, restrict unprivileged access to Bluetooth sockets by adjusting kernel parameters or using mandatory access controls. Disable unused Bluetooth services temporarily. Monitor vendor advisories for additional guidance.

Hi! I’m here to help you understand CVE-2026-98460. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70