Cloudanix VulnDB

CVE-2026-98247

None

CVSS

—

EPSS

0.2%

Published

Oct 6, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in how Linux reads responses from some Bluetooth hardware could let an attacker who controls that hardware crash the system or cause memory errors.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Data Exposure
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Out-of-bounds read in Bluetooth HCI codec response parsing: the vendor codec count byte is consumed after a variable-length standard codec array without ensuring sufficient remaining skb data, allowing access beyond the buffer when a controller reply terminates immediately after the array.

Why it matters to the business

Linux systems using Bluetooth may experience kernel crashes or memory corruption from malicious or faulty controllers, increasing downtime and patch urgency on affected devices even with low exploit probability.

How an attack unfolds

An attacker supplies a Bluetooth controller that returns a truncated response to the Read Local Supported Codecs command; the kernel parser advances past the standard codec array and then dereferences the vendor count field outside the received skb, triggering memory corruption.

How to fix it

Apply the upstream kernel patch that replaces direct access with skb_pull_data validation for each codec header before using its count field in both command variants.

How to confirm the fix worked

Inspect hci_codec.c for the skb_pull_data calls guarding vendor codec count access; confirm the fix by replaying truncated controller responses in a test environment and verifying no out-of-bounds access occurs.

Typical attack path

  1. Connect or emulate a malicious Bluetooth controller
  2. Issue Read Local Supported Codecs HCI command
  3. Return a response that ends exactly after the standard codec array
  4. Trigger out-of-bounds read on vendor codec count field

How to detect it

Review kernel logs and dmesg for oops or panic entries mentioning hci_codec, skb_pull, or vendor codec parsing failures following Bluetooth HCI command responses.

What your security team should do

  • Prioritize kernel updates on all Linux Bluetooth hosts
  • Disable Bluetooth interfaces where hardware support is unnecessary
  • Monitor kernel logs for hci or skb-related faults

The record

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_codec: validate vendor codec count length The Read Local Supported Codecs parsers consume the variable-sized standard codec array before parsing the vendor codec count. Although the initial reply-size check includes a vendor count byte in the fixed layout, it does not guarantee that the byte remains after the standard codec array. If a controller reply ends immediately after that array, calculating the vendor codec array size reads vnd_codecs->num beyond the skb data. Use skb_pull_data() to validate and consume each codec header before using its count in both command variants.

Affected packages

Ecosystem Package Introduced Fixed