CVE-2026-98460: Bluetooth: hci_sock: reject out-of-range OCF values
Bluetooth: hcisock: reject out-of-range OCF values
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Reject out-of-range or reserved OCF values that cannot be represented by the raw HCI socket security filter, instead of masking the 10-bit OCF with 127 and aliasing it to an unrelated allowlisted command.
Event History
Frequently Asked Questions
Who can exploit this issue?
A local unprivileged user that can create and use a raw Bluetooth HCI socket is the relevant attacker. Exploitation also depends on the socket security filter allowing a command whose OCF aliases the submitted reserved OCF modulo 128.
Does exploitation require a nonconforming Bluetooth controller?
No. A conforming controller should reject reserved opcodes, but the host-side security filter can still make an authorization decision for a different, allowlisted opcode. The risk exists because controller-specific handling of reserved opcodes is outside the host stack's control.
How can I determine whether a system needs the fix?
Check whether the running Linux kernel includes the stable commits referenced for this issue. Systems where unprivileged users can access raw HCI sockets are the most relevant to assess.