{"api_version":"1","generated_at":"2026-10-26T07:03:28+00:00","cve":"CVE-2026-98456","urls":{"html":"https://cve.report/CVE-2026-98456","api":"https://cve.report/api/cve/CVE-2026-98456.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-98456","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-98456"},"summary":{"title":"Bluetooth: mgmt: fix race in read_unconf_index_list()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: mgmt: fix race in read_unconf_index_list()\n\nread_unconf_index_list() counts unconfigured controllers before allocating\nits response, then checks the device flags again while filling it.\n\nhci_dev_list_lock stabilizes list membership, but it does not serialize the\nper-device flags. During asynchronous controller setup, the worker can set\nHCI_UNCONFIGURED and clear HCI_SETUP between the two passes. A controller\nomitted from the allocation count can then become eligible for the fill\npass, causing an out-of-bounds write to rp->index[].\n\nAllocate space for every device on hci_dev_list. Since list membership\ncannot change while hci_dev_list_lock is held, the response remains large\nenough regardless of flag transitions. The reported count and response\nlength still include only eligible unconfigured controllers.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-10-18 16:16:56","updated_at":"2026-10-24 14:16:42"},"problem_types":[],"metrics":[{"version":"3.1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","score":"7","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"7","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"baseScore":7,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"references":[{"url":"https://git.kernel.org/stable/c/2e8bba0360d1379bfa8da47c8f5dadbb10a3fba1","name":"https://git.kernel.org/stable/c/2e8bba0360d1379bfa8da47c8f5dadbb10a3fba1","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/b5dbb41b212c50c095a4dbee3017a84fe94f033b","name":"https://git.kernel.org/stable/c/b5dbb41b212c50c095a4dbee3017a84fe94f033b","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/416546cd6a54e9b68f2b91bc680b1ee17dcd77a1","name":"https://git.kernel.org/stable/c/416546cd6a54e9b68f2b91bc680b1ee17dcd77a1","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/8ddf962c76432a10a6cb80042875cbc48a9c056b","name":"https://git.kernel.org/stable/c/8ddf962c76432a10a6cb80042875cbc48a9c056b","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/524e0450dd9a396f99a81b045219b0e2ea0dab57","name":"https://git.kernel.org/stable/c/524e0450dd9a396f99a81b045219b0e2ea0dab57","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-98456","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98456","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 73d1df2a7a1036a1f000e5f0ece6ade3e082b854 524e0450dd9a396f99a81b045219b0e2ea0dab57 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 73d1df2a7a1036a1f000e5f0ece6ade3e082b854 8ddf962c76432a10a6cb80042875cbc48a9c056b git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 73d1df2a7a1036a1f000e5f0ece6ade3e082b854 416546cd6a54e9b68f2b91bc680b1ee17dcd77a1 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 73d1df2a7a1036a1f000e5f0ece6ade3e082b854 2e8bba0360d1379bfa8da47c8f5dadbb10a3fba1 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 73d1df2a7a1036a1f000e5f0ece6ade3e082b854 b5dbb41b212c50c095a4dbee3017a84fe94f033b git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 3.17","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 3.17 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.6.158 6.6.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.112 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.55 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2.9 7.2.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.3 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/bluetooth/mgmt.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"524e0450dd9a396f99a81b045219b0e2ea0dab57","status":"affected","version":"73d1df2a7a1036a1f000e5f0ece6ade3e082b854","versionType":"git"},{"lessThan":"8ddf962c76432a10a6cb80042875cbc48a9c056b","status":"affected","version":"73d1df2a7a1036a1f000e5f0ece6ade3e082b854","versionType":"git"},{"lessThan":"416546cd6a54e9b68f2b91bc680b1ee17dcd77a1","status":"affected","version":"73d1df2a7a1036a1f000e5f0ece6ade3e082b854","versionType":"git"},{"lessThan":"2e8bba0360d1379bfa8da47c8f5dadbb10a3fba1","status":"affected","version":"73d1df2a7a1036a1f000e5f0ece6ade3e082b854","versionType":"git"},{"lessThan":"b5dbb41b212c50c095a4dbee3017a84fe94f033b","status":"affected","version":"73d1df2a7a1036a1f000e5f0ece6ade3e082b854","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/bluetooth/mgmt.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.17"},{"lessThan":"3.17","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.158","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.112","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.55","versionType":"semver"},{"lessThanOrEqual":"7.2.*","status":"unaffected","version":"7.2.9","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.3","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.158","versionStartIncluding":"3.17","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.112","versionStartIncluding":"3.17","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.55","versionStartIncluding":"3.17","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2.9","versionStartIncluding":"3.17","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.3","versionStartIncluding":"3.17","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: mgmt: fix race in read_unconf_index_list()\n\nread_unconf_index_list() counts unconfigured controllers before allocating\nits response, then checks the device flags again while filling it.\n\nhci_dev_list_lock stabilizes list membership, but it does not serialize the\nper-device flags. During asynchronous controller setup, the worker can set\nHCI_UNCONFIGURED and clear HCI_SETUP between the two passes. A controller\nomitted from the allocation count can then become eligible for the fill\npass, causing an out-of-bounds write to rp->index[].\n\nAllocate space for every device on hci_dev_list. Since list membership\ncannot change while hci_dev_list_lock is held, the response remains large\nenough regardless of flag transitions. The reported count and response\nlength still include only eligible unconfigured controllers."}],"metrics":[{"cvssV3_1":{"baseScore":7,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"scenarios":[{"lang":"en","value":"AV:L - sendmsg() on a local PF_BLUETOOTH/BTPROTO_HCI socket bound to HCI_CHANNEL_CONTROL reaches hci_sock_sendmsg()->hci_mgmt_cmd()->read_unconf_index_list(). No over-the-air Bluetooth message supplies this management command or the corrupted data.\nAC:H - The overwrite requires the setup worker to set HCI_UNCONFIGURED and clear HCI_SETUP between read_unconf_index_list()'s sizing and filling walks. An untrusted management-socket caller cannot initiate or synchronize that controller-setup transition, so success depends on external timing.\nPR:L - mgmt_handlers[] marks MGMT_OP_READ_UNCONF_INDEX_LIST with HCI_MGMT_UNTRUSTED, and hci_sock_bind() permits HCI_CHANNEL_CONTROL binding without CAP_NET_ADMIN. Therefore any local user can issue the zero-length command.\nUI:N - The attacker can repeatedly send the management command without another user opening data or approving an operation; asynchronous controller setup is system state rather than required user interaction.\nS:U - The allocation and rp->index[] overwrite occur in read_unconf_index_list() within the host kernel heap, and no VM, IOMMU, or other security-authority boundary is crossed.\nC:H - When a newly eligible controller exceeds the allocation basis, rp->index[count++] writes 16-bit IDs past the kmalloc buffer and corrupts adjacent kernel heap storage; exploitable heap corruption can expose arbitrary kernel data.\nI:H - rp->index[count++] performs an out-of-bounds heap write for each newly eligible controller, allowing adjacent kernel objects to be modified and potentially enabling control-flow hijacking.\nA:H - The out-of-bounds writes can corrupt allocator or adjacent-object state and cause a kernel oops or panic, resulting in complete host availability loss."}]}],"providerMetadata":{"dateUpdated":"2026-10-24T14:08:55.253Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/524e0450dd9a396f99a81b045219b0e2ea0dab57"},{"url":"https://git.kernel.org/stable/c/8ddf962c76432a10a6cb80042875cbc48a9c056b"},{"url":"https://git.kernel.org/stable/c/416546cd6a54e9b68f2b91bc680b1ee17dcd77a1"},{"url":"https://git.kernel.org/stable/c/2e8bba0360d1379bfa8da47c8f5dadbb10a3fba1"},{"url":"https://git.kernel.org/stable/c/b5dbb41b212c50c095a4dbee3017a84fe94f033b"}],"title":"Bluetooth: mgmt: fix race in read_unconf_index_list()","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-98456","datePublished":"2026-10-18T15:15:05.909Z","dateReserved":"2026-09-25T10:25:14.350Z","dateUpdated":"2026-10-24T14:08:55.253Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-10-18 16:16:56","lastModifiedDate":"2026-10-24 14:16:42","problem_types":[],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1,"impactScore":5.9}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"98456","Ordinal":"1","Title":"Bluetooth: mgmt: fix race in read_unconf_index_list()","CVE":"CVE-2026-98456","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"98456","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: mgmt: fix race in read_unconf_index_list()\n\nread_unconf_index_list() counts unconfigured controllers before allocating\nits response, then checks the device flags again while filling it.\n\nhci_dev_list_lock stabilizes list membership, but it does not serialize the\nper-device flags. During asynchronous controller setup, the worker can set\nHCI_UNCONFIGURED and clear HCI_SETUP between the two passes. A controller\nomitted from the allocation count can then become eligible for the fill\npass, causing an out-of-bounds write to rp->index[].\n\nAllocate space for every device on hci_dev_list. Since list membership\ncannot change while hci_dev_list_lock is held, the response remains large\nenough regardless of flag transitions. The reported count and response\nlength still include only eligible unconfigured controllers.","Type":"Description","Title":"Bluetooth: mgmt: fix race in read_unconf_index_list()"}]}}}