CVE-2026-98247: Bluetooth: hci_codec: validate vendor codec count length
Bluetooth: hcicodec: validate vendor codec count length
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Use skb_pull_data() to validate and consume each codec header before using its fields, and parse the vendor codec count only after validating and consuming the standard codec array.
Event History
Frequently Asked Questions
What would an attacker need to control to trigger this issue?
They would need to cause the kernel Bluetooth stack to process a malformed Read Local Supported Codecs controller reply that ends after the standard codec array, before the vendor codec count byte is available.
Which code paths are affected?
The issue affects both command variants that parse Read Local Supported Codecs replies and use the vendor codec count after consuming a variable-sized standard codec array.
What is the immediate mitigation if an update cannot be applied?
The provided information does not identify a configuration workaround. Reducing exposure to untrusted or malfunctioning Bluetooth controllers may limit opportunities for malformed controller replies to reach the affected parser.