Cloudanix VulnDB

CVE-2026-98461

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in Linux Bluetooth handling could let a nearby device read small amounts of system memory or cause crashes if it sends unusual signals.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Data Exposure
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Out-of-bounds read in hci_sock event filtering path when a malformed Bluetooth event lacks sufficient length for the inspected fields, triggered before standard header validation.

Why it matters to the business

Potential kernel memory disclosure or system instability on Linux hosts with Bluetooth enabled; low immediate risk but requires prompt patching to maintain device integrity across fleets.

How an attack unfolds

An attacker supplies a crafted short HCI event via a malicious Bluetooth controller or vhci device; the filter in hci_send_to_sock reads beyond the skb without length checks, causing the out-of-bounds access.

How to fix it

Update the Linux kernel to a version containing the fix for the hci_sock event length validation; rebuild and reboot affected systems.

How to confirm the fix worked

Confirm the patched kernel source contains the length checks before skb->data[0] and opcode accesses in is_filtered_packet; test with deliberately truncated HCI events.

Typical attack path

  1. Attach or emulate a Bluetooth controller capable of injecting events
  2. Send a truncated Command Complete, Command Status, or other event lacking required opcode or header bytes
  3. Trigger hci_send_to_sock with an active opcode filter to exercise the unchecked reads
  4. Observe kernel behavior for disclosure or crash

How to detect it

Review kernel logs for Bluetooth HCI event processing errors or oops involving hci_sock; inspect vhci or controller traces for unusually short events.

What your security team should do

  • Prioritize kernel updates on all Bluetooth-enabled Linux endpoints within standard patch windows
  • Disable Bluetooth where not required to reduce attack surface
  • Monitor for future Bluetooth-related kernel advisories given the subsystem history

The record

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sock: validate event length before filtering is_filtered_packet() reads the event code from skb->data[0] without first checking that the skb is nonempty. When an opcode filter is configured, it also reads the command opcode at offsets 3 or 4 without checking that a Command Complete or Command Status event is long enough. hci_send_to_sock() invokes the filter before hci_event_packet() validates the event header. A malformed event supplied by a controller or a vhci device can therefore cause an out-of-bounds read. Keep the unmasked event code for the opcode checks. The masked value is needed for the 64-bit event bitmap, but using it to identify command events aliases event codes above 0x3f. In particular, Synchronous Train Complete (0x4f) was treated as Command Status (0x0f) even though its payload has no opcode. Reject actual command events that are too short for the field being inspected. A truncated command event cannot match a configured opcode.

Affected packages

Ecosystem Package Introduced Fixed