CVE-2026-98460

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_sock: reject out-of-range OCF values

The raw HCI socket security filter has 128 OCF bits per supported OGF,

but masks the 10-bit OCF with 127 before looking up the command. An

unprivileged socket can therefore submit a reserved OCF that aliases an

allowlisted command modulo 128.

A conforming controller should reject reserved opcodes. Nevertheless,

the security decision must apply to the opcode that will actually be

sent, especially since controller-specific behavior is outside the host

stack's control.

Reject OCF values that cannot be represented by the security filter

instead of aliasing them onto an unrelated command.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References