CVE-2026-98456

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: mgmt: fix race in read_unconf_index_list()

read_unconf_index_list() counts unconfigured controllers before allocating

its response, then checks the device flags again while filling it.

hci_dev_list_lock stabilizes list membership, but it does not serialize the

per-device flags. During asynchronous controller setup, the worker can set

HCI_UNCONFIGURED and clear HCI_SETUP between the two passes. A controller

omitted from the allocation count can then become eligible for the fill

pass, causing an out-of-bounds write to rp->index[].

Allocate space for every device on hci_dev_list. Since list membership

cannot change while hci_dev_list_lock is held, the response remains large

enough regardless of flag transitions. The reported count and response

length still include only eligible unconfigured controllers.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References