Cloudanix VulnDB

CVE-2026-98460

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A Linux kernel Bluetooth issue could let ordinary user programs send device commands that should be blocked, giving them more control than intended over wireless hardware.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Privilege Gain
Component
OS kernel
Class
Authorization Bypass
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The raw HCI socket security filter masks 10-bit OCF values with 127 before lookup against its 128-bit allowlist per OGF, enabling an unprivileged socket to submit a reserved OCF that aliases an allowed command modulo 128 and bypasses the intended restriction.

Why it matters to the business

Unprivileged local processes could send unauthorized Bluetooth HCI commands, potentially enabling low-privilege users to perform restricted radio or device operations with minimal external exploit risk given the low EPSS and lack of known campaigns.

How an attack unfolds

An attacker with unprivileged local access opens a raw HCI socket, crafts an HCI command packet whose OCF value exceeds the filter range yet aliases an allowlisted opcode after the modulo-128 mask, and submits it so the controller receives and acts on the aliased privileged command.

How to fix it

Upgrade the Linux kernel to a version containing the fix that rejects OCF values outside the representable security-filter range before any command lookup occurs.

How to confirm the fix worked

Confirm the running kernel contains the hci_sock OCF-range rejection change; attempt to open a raw HCI socket and submit an out-of-range OCF to verify the kernel now returns an error instead of aliasing the command.

Typical attack path

  1. Obtain unprivileged local shell or process
  2. Open AF_BLUETOOTH SOCK_RAW HCI socket
  3. Construct HCI command with reserved OCF that aliases allowed command modulo 128
  4. Transmit command bypassing the security filter
  5. Receive controller response for the aliased privileged operation

How to detect it

Inspect kernel audit logs and Bluetooth subsystem traces for raw HCI socket creation followed by command opcodes that would have been masked; correlate with processes lacking Bluetooth privileges attempting non-standard OCF values.

What your security team should do

  • Apply the kernel patch addressing the HCI socket filter masking issue as soon as vendor packages become available
  • Limit raw HCI socket creation to trusted processes via LSM or seccomp policies where feasible
  • Review Bluetooth stack usage and disable raw HCI sockets if not required

The record

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sock: reject out-of-range OCF values The raw HCI socket security filter has 128 OCF bits per supported OGF, but masks the 10-bit OCF with 127 before looking up the command. An unprivileged socket can therefore submit a reserved OCF that aliases an allowlisted command modulo 128. A conforming controller should reject reserved opcodes. Nevertheless, the security decision must apply to the opcode that will actually be sent, especially since controller-specific behavior is outside the host stack's control. Reject OCF values that cannot be represented by the security filter instead of aliasing them onto an unrelated command.

Affected packages

Ecosystem Package Introduced Fixed