{"id":"CVE-2026-98456","kind":"vulnerability","aliases":["CVE-2026-98456"],"related":[],"title":"Linux kernel: Bluetooth mgmt race lets userspace write out of bounds","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: mgmt: fix race in read_unconf_index_list()\n\nread_unconf_index_list() counts unconfigured controllers before allocating\nits response, then checks the device flags again while filling it.\n\nhci_dev_list_lock stabilizes list membership, but it does not serialize the\nper-device flags. During asynchronous controller setup, the worker can set\nHCI_UNCONFIGURED and clear HCI_SETUP between the two passes. A controller\nomitted from the allocation count can then become eligible for the fill\npass, causing an out-of-bounds write to rp->index[].\n\nAllocate space for every device on hci_dev_list. Since list membership\ncannot change while hci_dev_list_lock is held, the response remains large\nenough regardless of flag transitions. The reported count and response\nlength still include only eligible unconfigured controllers.","summary":"A race in the Linux kernel Bluetooth management interface can cause an out-of-bounds write when listing unconfigured controllers. The sources do not say what an attacker gets beyond memory corruption in the kernel.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bluetooth","infrastructure","linux-kernel"],"not_affected_if":["no-bluetooth-hardware"],"how_to_check":"- `uname -r` to see the running kernel version\n- unknown whether the sources list affected kernel versions","fix":"- Update the Linux kernel to a release that includes the upstream commit fixing read_unconf_index_list() (version unknown from sources)\n- Reboot after the kernel update so the fix is active","status":"open","published_at":"2026-10-18T16:16:56+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T05:27:18+00:00","updated_at":"2026-10-25T05:27:18+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-10-25T05:27:18Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream commit fixing read_unconf_index_list() (version unknown from sources)\n- Reboot after the kernel update so the fix is active","reach":"local","title":"Linux kernel: Bluetooth mgmt race lets userspace write out of bounds","impact":"medium","summary":"A race in the Linux kernel Bluetooth management interface can cause an out-of-bounds write when listing unconfigured controllers. The sources do not say what an attacker gets beyond memory corruption in the kernel.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","bluetooth"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown; kernel out-of-bounds write may corrupt memory","analyst_note":"Confirm affected kernel version ranges and whether the trigger needs local access, using the NVD entry and the upstream kernel commit.","how_to_check":"- `uname -r` to see the running kernel version\n- unknown whether the sources list affected kernel versions","needs_analyst":true,"not_affected_if":["no-bluetooth-hardware"],"who_is_affected":"Systems running a Linux kernel with Bluetooth support and the management interface in use, typically desktops, laptops and devices with Bluetooth controllers. The sources do not say whether headless servers without Bluetooth hardware are affected or whether a local user can trigger it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000621,"input_tokens":3512,"output_tokens":539,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-98456':14A,17A 'alloc':86C,138C,158C 'asynchron':116C 'attack':51B 'becom':142C 'beyond':53B 'bluetooth':3A,18B,29B,69C 'bound':11A,38B,153C 'cannot':170C 'caus':33B,148C 'chang':171C 'check':90C 'clear':126C 'control':43B,84C,117C,134C,199C 'corrupt':55B 'count':82C,139C,190C 'cve':12A,15A 'dev':99C,165C,174C 'devic':92C,113C,162C 'elig':143C,197C 'enough':183C 'everi':161C 'fill':96C,146C 'fix':71C 'flag':93C,114C,186C 'follow':64C 'get':52B 'hci':98C,123C,127C,164C,173C 'held':178C 'includ':195C 'index':76C,80C,157C 'infrastructur':19B 'interfac':31B 'kernel':2A,22B,28B,58B,62C 'larg':182C 'length':193C 'let':6A 'linux':1A,21B,27B,61C 'linux-kernel':20B 'list':41B,77C,81C,100C,103C,166C,168C,175C 'lock':101C,176C 'manag':30B 'membership':104C,169C 'memori':54B 'mgmt':4A,70C 'omit':135C 'out-of-bound':35B,150C 'pass':132C,147C 'per':112C 'per-devic':111C 'race':5A,24B,72C 'read':74C,78C 'regardless':184C 'remain':181C 'report':189C 'resolv':68C 'respons':88C,180C,192C 'rp':156C 'say':48B 'serial':109C 'set':122C 'setup':118C,128C 'sinc':167C 'sourc':45B 'space':159C 'stabil':102C 'still':194C 'transit':187C 'two':131C 'unconf':75C,79C 'unconfigur':42B,83C,124C,198C 'userspac':7A 'vulner':65C 'worker':120C 'write':8A,39B,154C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with Bluetooth support and the management interface in use, typically desktops, laptops and devices with Bluetooth controllers. The sources do not say whether headless servers without Bluetooth hardware are affected or whether a local user can trigger it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:16:56+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98456","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98456","severity":null,"published_at":"2026-10-18T16:16:56+00:00","modified_at":"2026-10-19T10:18:54+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}