All vulnerabilities
CVE-2026-98456

Linux: Bluetooth: mgmt: fix race in read_unconf_index_list()

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 5% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in524e0450dd9a396f99a81b045219b0e2ea0dab57Also 8ddf962c76432a10a6cb80042875cbc48a9c056b, 416546cd6a54e9b68f2b91bc680b1ee17dcd77a1 and 1 moreCVE List
Published18 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 524e0450dd9a396f99a81b045219b0e2ea0dab57LinuxCVE List
  • 8ddf962c76432a10a6cb80042875cbc48a9c056bLinuxCVE List
  • 416546cd6a54e9b68f2b91bc680b1ee17dcd77a1LinuxCVE List
  • 2e8bba0360d1379bfa8da47c8f5dadbb10a3fba1LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: mgmt: fix race in read_unconf_index_list()

read_unconf_index_list() counts unconfigured controllers before allocating its response, then checks the device flags again while filling it.

hci_dev_list_lock stabilizes list membership, but it does not serialize the per-device flags. During asynchronous controller setup, the worker can set HCI_UNCONFIGURED and clear HCI_SETUP between the two passes. A controller omitted from the allocation count can then become eligible for the fill pass, causing an out-of-bounds write to rp->index[].

Allocate space for every device on hci_dev_list. Since list membership cannot change while hci_dev_list_lock is held, the response remains large enough regardless of flag transitions. The reported count and response length still include only eligible unconfigured controllers.

Text from CVE List

Affected versions 12

  • Linuxaffected: 73d1df2a7a1036a1f000e5f0ece6ade3e082b854 before 524e0450dd9a396f99a81b045219b0e2ea0dab57CVE List
  • Linuxaffected: 73d1df2a7a1036a1f000e5f0ece6ade3e082b854 before 8ddf962c76432a10a6cb80042875cbc48a9c056bCVE List
  • Linuxaffected: 73d1df2a7a1036a1f000e5f0ece6ade3e082b854 before 416546cd6a54e9b68f2b91bc680b1ee17dcd77a1CVE List
  • Linuxaffected: 73d1df2a7a1036a1f000e5f0ece6ade3e082b854 before 2e8bba0360d1379bfa8da47c8f5dadbb10a3fba1CVE List
  • Linuxaffected: 73d1df2a7a1036a1f000e5f0ece6ade3e082b854 before b5dbb41b212c50c095a4dbee3017a84fe94f033bCVE List
  • Linuxaffected: 3.17CVE List
  • Linuxunaffected: all versions before 3.17CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.112 through 6.12.*CVE List
  • Linuxunaffected: 6.18.55 through 6.18.*CVE List
  • Linuxunaffected: 7.2.9 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5