SB2026102230 - Incorrect authorization in Linux kernel bluetooth

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026102230

SB2026102230 - Incorrect authorization in Linux kernel bluetooth

Published: October 22, 2026

Security Bulletin ID SB2026102230
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Local access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Incorrect authorization (CVE-ID: CVE-2026-98460)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local user to bypass Bluetooth HCI command restrictions and submit reserved opcodes through an unprivileged raw HCI socket.

The vulnerability exists due to improper authorization in the Linux kernel Bluetooth raw HCI socket security filter when checking command opcodes. A local user can submit a reserved opcode whose 10-bit opcode command field (OCF) aliases an allowlisted command after masking with 127 to bypass the command security filter.

A conforming controller should reject reserved opcodes.


Remediation

Install update from vendor's website.

References