CVE-2026-98461Bluetooth: hci_sock: validate event length before filtering
- —Not scoredno CVSS score yet
- 0.22%Exploitation in 30 daysEPSS · top 88% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sock: validate event length before filtering is_filtered_packet() reads the event code from skb->data[0] without first checking that the skb is nonempty. When an opcode filter is configured, it also reads the command opcode at offsets 3 or 4 without checking that a Command Complete or Command Status event is long enough. hci_send_to_sock() invokes the filter before hci_event_packet() validates the event header. A malformed event supplied by a controller or a vhci device can therefore cause an out-of-bounds read. Keep the unmasked event code for the opcode checks. The masked value is needed for the 64-bit event bitmap, but using it to identify command events aliases event codes above 0x3f. In particular, Synchronous Train Complete (0x4f) was treated as Command Status (0x0f) even though its payload has no opcode. Reject actual command events that are too short for the field being inspected. A truncated command event cannot match a configured opcode.
Timeline
ID reserved
By Linux
- 23 days later
· 23 days later
Published
- 1 day later
· 1 day later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
No CVSS score yet: neither the CNA, CISA nor NVD has scored this CVE. NVD status: Received.
- EPSS (exploitation in 30 days)
- 0.22% · top 88% of all CVEs (12 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Not scored.
Affected products
- affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 – < 39e99d85071bca0feeec3164a9437ca1bff297fc
- affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 – < ebdd49cec380731844ed9df4092a29a014623df4
- affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 – < 2501a3b7b7144d1d11939b355a48ed01f83d0c62
- affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 – < dca25c204f71be0556a15177dbe037237ac43e5e
- affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 – < 3976bbcd43b9b94c53ac9b0fd28888011588f4cc
- affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 – < f894f6292d5122cd62d30600736b4a0ae79f7770
- affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 – < 1a92763c2ba721bf113cd83f913fe8c511b4a4dc
- affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 – < b0a6cf99afd57a39598b1beca0e86ef5004980de
- affected 2.6.12
- unaffected < 2.6.12
- unaffected 5.10.271 – ≤ 5.10.*
- unaffected 5.15.222 – ≤ 5.15.*
- unaffected 6.1.189 – ≤ 6.1.*
- unaffected 6.6.158 – ≤ 6.6.*
- unaffected 6.12.112 – ≤ 6.12.*
- unaffected 6.18.55 – ≤ 6.18.*
- unaffected 7.2.9 – ≤ 7.2.*
- unaffected 7.3 – ≤ *
References
References8
- https://git.kernel.org/stable/c/39e99d85071bca0feeec3164a9437ca1bff297fc (opens in a new tab)
- https://git.kernel.org/stable/c/ebdd49cec380731844ed9df4092a29a014623df4 (opens in a new tab)
- https://git.kernel.org/stable/c/2501a3b7b7144d1d11939b355a48ed01f83d0c62 (opens in a new tab)
- https://git.kernel.org/stable/c/dca25c204f71be0556a15177dbe037237ac43e5e (opens in a new tab)
- https://git.kernel.org/stable/c/3976bbcd43b9b94c53ac9b0fd28888011588f4cc (opens in a new tab)
- https://git.kernel.org/stable/c/f894f6292d5122cd62d30600736b4a0ae79f7770 (opens in a new tab)
- https://git.kernel.org/stable/c/1a92763c2ba721bf113cd83f913fe8c511b4a4dc (opens in a new tab)
- https://git.kernel.org/stable/c/b0a6cf99afd57a39598b1beca0e86ef5004980de (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-103701 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-98461)Record last updated .