Out-of-bounds read in Linux kernel - CVE-2026-98247

Vulnerability details

The vulnerability allows a local user to trigger an out-of-bounds read.

The vulnerability exists due to an out-of-bounds read in the Bluetooth Read Local Supported Codecs parsers when processing a controller reply that ends immediately after the standard codec array. A local user can supply such a reply to trigger an out-of-bounds read.

The vendor codec count is accessed beyond the socket buffer data while calculating the vendor codec array size. Both command variants are affected.

Affected software

How to mitigate CVE-2026-98247

External References

• https://git.kernel.org/stable/c/12a82819b0cada6e304790b1097f8f9006eb6123
• https://git.kernel.org/stable/c/9c04b9a4d08b95dee901d24b7607c4cbd65fa0a8
• https://git.kernel.org/stable/c/a6da782fefae611e68a1aa79644065fc8ca5abcd
• https://git.kernel.org/stable/c/d0795cfd6f655f4de84868a4f4bb41a03f037b3d
• https://git.kernel.org/stable/c/e4cfd3c4299105237458b27958bd7b0aa4c60795
• https://git.kernel.org/stable/c/f49a543d76d48f184b34225d9c0e2fc4cbdea8ec

Related Security Bulletins

• Out-of-bounds read in Linux kernel bluetooth
• Debian update for linux