SB2026102670 - Return of Wrong Status Code in Linux kernel bluetooth

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026102670

SB2026102670 - Return of Wrong Status Code in Linux kernel bluetooth

Published: October 26, 2026

Security Bulletin ID SB2026102670
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Local access
Highest impact Partial DoS

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Return of Wrong Status Code (CVE-ID: CVE-2026-99091)

CWE-ID: CWE-393 - Return of Wrong Status Code

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a local user to cause a denial of service in Bluetooth management clients that mishandle incorrectly reported command success.

The vulnerability exists due to incorrect status propagation in the Linux kernel Bluetooth management function cmd_complete_rsp() when pending commands are flushed during adapter power-off or removal. A local user can trigger these conditions while a command without a completion callback is pending to cause the socket pointer's first byte to be returned as the command status instead of the intended error status. An incorrect success response with no parameters can crash affected clients, as observed with bluetoothd 5.72 handling a pending Start Discovery command.


Remediation

Install update from vendor's website.

References