CVE-2026-98456
Received Received - Intake

Race Condition in Linux Kernel Bluetooth Management Leads to Out-of-Bounds Write

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix race in read_unconf_index_list() read_unconf_index_list() counts unconfigured controllers before allocating its response, then checks the device flags again while filling it. hci_dev_list_lock stabilizes list membership, but it does not serialize the per-device flags. During asynchronous controller setup, the worker can set HCI_UNCONFIGURED and clear HCI_SETUP between the two passes. A controller omitted from the allocation count can then become eligible for the fill pass, causing an out-of-bounds write to rp->index[]. Allocate space for every device on hci_dev_list. Since list membership cannot change while hci_dev_list_lock is held, the response remains large enough regardless of flag transitions. The reported count and response length still include only eligible unconfigured controllers.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98456
EUVD
EUVD-2026-103696

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
Linux Linux 73d1df2a7a1036a1f000e5f0ece6ade3e082b854
Linux Linux 73d1df2a7a1036a1f000e5f0ece6ade3e082b854
Linux Linux 73d1df2a7a1036a1f000e5f0ece6ade3e082b854
Linux Linux 73d1df2a7a1036a1f000e5f0ece6ade3e082b854
Linux Linux 73d1df2a7a1036a1f000e5f0ece6ade3e082b854
Linux Linux 3.17

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a race condition in the Linux kernel's Bluetooth management subsystem. The function read_unconf_index_list() counts unconfigured Bluetooth controllers before allocating memory for the response. However, between counting and filling the response, a controller's setup state can change asynchronously, leading to an out-of-bounds write when the response buffer is too small.

Detection Guidance

This vulnerability is specific to the Linux kernel's Bluetooth management subsystem and requires kernel-level inspection. Detection involves checking kernel logs for Bluetooth-related errors or crashes, particularly during controller setup. Commands like dmesg | grep -i bluetooth or journalctl -k | grep -i bluetooth may reveal issues. However, no direct detection commands are provided in the context.

Impact Analysis

This vulnerability could allow an attacker to corrupt kernel memory by exploiting the race condition. This might lead to system crashes, privilege escalation, or other malicious activities depending on the attacker's goals and system configuration.

Mitigation Strategies

Update the Linux kernel to the latest patched version to resolve this issue. Monitor vendor advisories for kernel updates addressing CVE-2026-98456. Avoid using Bluetooth controllers during system boot until patched. Disable Bluetooth if not in use as a temporary workaround.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98456. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart