CVE-2026-98456Bluetooth: mgmt: fix race in read_unconf_index_list()
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix race in read_unconf_index_list() read_unconf_index_list() counts unconfigured controllers before allocating its response, then checks the device flags again while filling it. hci_dev_list_lock stabilizes list membership, but it does not serialize the per-device flags. During asynchronous controller setup, the worker can set HCI_UNCONFIGURED and clear HCI_SETUP between the two passes. A controller omitted from the allocation count can then become eligible for the fill pass, causing an out-of-bounds write to rp->index[]. Allocate space for every device on hci_dev_list. Since list membership cannot change while hci_dev_list_lock is held, the response remains large enough regardless of flag transitions. The reported count and response length still include only eligible unconfigured controllers.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 19, 2026
- First seen by InfoSec Signals
- Oct 18, 2026
Affected products
Linux Linux linux:linux (from the name) | from 73d1df2a7a1036a1f000e5f0ece6ade3e082b854 before 524e0450dd9a396f99a81b045219b0e2ea0dab57; 73d1df2a7a1036a1f000e5f0ece6ade3e082b854 builds before 8ddf962c76432a10a6cb80042875cbc48a9c056b; from 73d1df2a7a1036a1f000e5f0ece6ade3e082b854 before 416546cd6a54e9b68f2b91bc680b1ee17dcd77a1; 73d1df2a7a1036a1f000e5f0ece6ade3e082b854 builds before 2e8bba0360d1379bfa8da47c8f5dadbb10a3fba1; from 73d1df2a7a1036a1f000e5f0ece6ade3e082b854 before b5dbb41b212c50c095a4dbee3017a84fe94f033b | CNA record |
References
- https://git.kernel.org/stable/c/524e0450dd9a396f99a81b045219b0e2ea0dab57
- https://git.kernel.org/stable/c/8ddf962c76432a10a6cb80042875cbc48a9c056b
- https://git.kernel.org/stable/c/416546cd6a54e9b68f2b91bc680b1ee17dcd77a1
- https://git.kernel.org/stable/c/2e8bba0360d1379bfa8da47c8f5dadbb10a3fba1
- https://git.kernel.org/stable/c/b5dbb41b212c50c095a4dbee3017a84fe94f033b
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.