CVE-2026-98456

Bluetooth: mgmt: fix race in read_unconf_index_list()

State: Published
Severity: 7.0 High
Published: Oct 18, 2026
Updated: Oct 30, 2026
Reserved: Sep 25, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: mgmt: fix race in read_unconf_index_list()

read_unconf_index_list() counts unconfigured controllers before allocating its response, then checks the device flags again while filling it.

hci_dev_list_lock stabilizes list membership, but it does not serialize the per-device flags. During asynchronous controller setup, the worker can set HCI_UNCONFIGURED and clear HCI_SETUP between the two passes. A controller omitted from the allocation count can then become eligible for the fill pass, causing an out-of-bounds write to rp->index[].

Allocate space for every device on hci_dev_list. Since list membership cannot change while hci_dev_list_lock is held, the response remains large enough regardless of flag transitions. The reported count and response length still include only eligible unconfigured controllers.

Scores

CVSS	Score	Vector	Source
3.1	7.0 High	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	73d1df2a7a1036a1f000e5f0ece6ade3e082b854 to before fa6f79bb0009406bb11e6912b53ab7c564d6f06bAffected 73d1df2a7a1036a1f000e5f0ece6ade3e082b854 to before 76dc7e0297f6f7ebefc36a69251e3f4a676d9853Affected 73d1df2a7a1036a1f000e5f0ece6ade3e082b854 to before 9c32455f490b960efccedd041c7aabb1a04c5cc4Affected 73d1df2a7a1036a1f000e5f0ece6ade3e082b854 to before 524e0450dd9a396f99a81b045219b0e2ea0dab57Affected 73d1df2a7a1036a1f000e5f0ece6ade3e082b854 to before 8ddf962c76432a10a6cb80042875cbc48a9c056bAffected 73d1df2a7a1036a1f000e5f0ece6ade3e082b854 to before 416546cd6a54e9b68f2b91bc680b1ee17dcd77a1Affected 73d1df2a7a1036a1f000e5f0ece6ade3e082b854 to before 2e8bba0360d1379bfa8da47c8f5dadbb10a3fba1Affected 73d1df2a7a1036a1f000e5f0ece6ade3e082b854 to before b5dbb41b212c50c095a4dbee3017a84fe94f033bAffected
LinuxLinux	3.17Affected before 3.17Not affected 5.10.273 through 5.10.Not affected 5.15.224 through 5.15.Not affected 6.1.191 through 6.1.Not affected 6.6.158 through 6.6.Not affected 6.12.112 through 6.12.Not affected 6.18.55 through 6.18.Not affected 7.2.9 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

73d1df2a7a1036a1f000e5f0ece6ade3e082b854 to before fa6f79bb0009406bb11e6912b53ab7c564d6f06bAffected
73d1df2a7a1036a1f000e5f0ece6ade3e082b854 to before 76dc7e0297f6f7ebefc36a69251e3f4a676d9853Affected
73d1df2a7a1036a1f000e5f0ece6ade3e082b854 to before 9c32455f490b960efccedd041c7aabb1a04c5cc4Affected
73d1df2a7a1036a1f000e5f0ece6ade3e082b854 to before 524e0450dd9a396f99a81b045219b0e2ea0dab57Affected
73d1df2a7a1036a1f000e5f0ece6ade3e082b854 to before 8ddf962c76432a10a6cb80042875cbc48a9c056bAffected
73d1df2a7a1036a1f000e5f0ece6ade3e082b854 to before 416546cd6a54e9b68f2b91bc680b1ee17dcd77a1Affected
73d1df2a7a1036a1f000e5f0ece6ade3e082b854 to before 2e8bba0360d1379bfa8da47c8f5dadbb10a3fba1Affected
73d1df2a7a1036a1f000e5f0ece6ade3e082b854 to before b5dbb41b212c50c095a4dbee3017a84fe94f033bAffected

LinuxLinux

3.17Affected
before 3.17Not affected
5.10.273 through 5.10.*Not affected
5.15.224 through 5.15.*Not affected
6.1.191 through 6.1.*Not affected
6.6.158 through 6.6.*Not affected
6.12.112 through 6.12.*Not affected
6.18.55 through 6.18.*Not affected
7.2.9 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.