CVE-2026-98456

What it actually does

Race condition in read_unconf_index_list() allows an out-of-bounds write to the rp->index[] array when HCI_UNCONFIGURED and HCI_SETUP flags change between counting and response-filling passes under hci_dev_list_lock.

Why it matters to the business

Linux kernel systems using Bluetooth may experience crashes, memory corruption, or local privilege escalation; the flaw is five days old with low but stable exploit probability and no known in-the-wild use.

How an attack unfolds

An attacker with local access triggers asynchronous controller setup timing so that a device is omitted from the initial count but becomes eligible during the fill pass, writing past the allocated response buffer.

How to fix it

Update to a Linux kernel containing the fix that allocates space for every device on the hci_dev_list before the fill pass; rebuild and reboot affected systems.

How to confirm the fix worked

Confirm the kernel source contains the allocation change for every hci_dev entry under hci_dev_list_lock and that only eligible unconfigured controllers are counted in the response length.

Typical attack path

1. Obtain local code execution on a Linux host with Bluetooth mgmt socket access
2. Race the hci_dev worker thread during controller initialization to flip HCI_UNCONFIGURED/HCI_SETUP flags
3. Invoke read_unconf_index_list() while the lock is held to trigger the count/fill mismatch
4. Perform out-of-bounds write to achieve kernel memory corruption or escalation

How to detect it

Inspect kernel logs for oops or panic entries referencing read_unconf_index_list or mgmt; look for unexpected Bluetooth controller enumeration failures around the time of any local process activity on the mgmt socket.

What your security team should do

• Prioritize kernel updates on all multi-user or exposed Linux systems within the next patch cycle
• Monitor EPSS trend and any future KEV listing for increased urgency
• Restrict unprivileged access to the Bluetooth management socket until patched