Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Linux kernel Bluetooth can write outside memory
published 17 days ago
Summary
Versions of the Linux kernel earlier than 6.6.159.1-1 have a bug in the Bluetooth management code that can accidentally write past the end of a memory buffer. This could cause the system to crash or be exploited by an attacker. Install the latest kernel updates from your distribution or vendor to resolve the issue.
What to do
- Update kernel to version 6.6.159.1-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Azure Linux:3 | – | kernel |
< 6.6.159.1-1 Fix: upgrade to 6.6.159.1-1
|
| Azure Linux:3 | azure | kernel | <= 6.6.157.1-1 |
Original advisory text
CVE-2026-98456 affecting package kernel for versions less than 6.6.159.1-1
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: mgmt: fix race in read_unconf_index_list()
read_unconf_index_list() counts unconfigured controllers before allocating
its response, then checks the device flags again while filling it.
hci_dev_list_lock stabilizes list membership, but it does not serialize the
per-device flags. During asynchronous controller setup, the worker can set
HCI_UNCONFIGURED and clear HCI_SETUP between the two passes. A controller
omitted from the allocation count can then become eligible for the fill
pass, causing an out-of-bounds write to rp->index[].
Allocate space for every device on hci_dev_list. Since list membership
cannot change while hci_dev_list_lock is held, the response remains large
enough regardless of flag transitions. The reported count and response
length still include only eligible unconfigured controllers.
Bluetooth: mgmt: fix race in read_unconf_index_list()
read_unconf_index_list() counts unconfigured controllers before allocating
its response, then checks the device flags again while filling it.
hci_dev_list_lock stabilizes list membership, but it does not serialize the
per-device flags. During asynchronous controller setup, the worker can set
HCI_UNCONFIGURED and clear HCI_SETUP between the two passes. A controller
omitted from the allocation count can then become eligible for the fill
pass, causing an out-of-bounds write to rp->index[].
Allocate space for every device on hci_dev_list. Since list membership
cannot change while hci_dev_list_lock is held, the response remains large
enough regardless of flag transitions. The reported count and response
length still include only eligible unconfigured controllers.
References
Timeline
Published18 Oct 2026
Updated2 Nov 2026
First seen21 Oct 2026
Sources
AZL-108825 · OSV
Track software like this
Free during beta