Incorrect authorization in Linux kernel - CVE-2026-98460

Vulnerability identifier: #VU156758

CSH Severity: Low

CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-98460

CWE-ID: CWE-863

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to bypass Bluetooth HCI command restrictions and submit reserved opcodes through an unprivileged raw HCI socket.

The vulnerability exists due to improper authorization in the Linux kernel Bluetooth raw HCI socket security filter when checking command opcodes. A local user can submit a reserved opcode whose 10-bit opcode command field (OCF) aliases an allowlisted command after masking with 127 to bypass the command security filter.

A conforming controller should reject reserved opcodes.

Linux kernel
Ubuntu
linux-nvidia-tegra (Ubuntu package)
linux-nvidia-tegra-igx (Ubuntu package)
linux-nvidia-tegra-5.15 (Ubuntu package)
linux (Ubuntu package)
linux-gcp (Ubuntu package)
linux-oracle (Ubuntu package)
linux-aws (Ubuntu package)
linux-ibm (Ubuntu package)
linux-hwe-7.0 (Ubuntu package)
linux-oem-7.0 (Ubuntu package)

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
linux-nvidia-tegra (Ubuntu package) - update to 5.15.0-1070.72
linux-nvidia-tegra-igx (Ubuntu package) - update to 5.15.0-1059.59
linux-nvidia-tegra-5.15 (Ubuntu package) - update to 5.15.0-1070.72~20.04.1
linux (Ubuntu package) - update to 7.0.0-42.42
linux-gcp (Ubuntu package) - update to 7.0.0-1016.18
linux-oracle (Ubuntu package) - update to 7.0.0-1015.16
linux-aws (Ubuntu package) - update to 7.0.0-1016.17
linux-ibm (Ubuntu package) - update to 7.0.0-1017.17
linux-hwe-7.0 (Ubuntu package) - update to 7.0.0-42.42~24.04.1
linux-oem-7.0 (Ubuntu package) - update to 7.0.0-1017.17

• https://git.kernel.org/stable/c/173457fa3e99ef4188dd0fe63e4dee98d0e441a9
• https://git.kernel.org/stable/c/320dedad15e8bbaecc8d2d7fd4189defb84caa85
• https://git.kernel.org/stable/c/47d67ec424e63e61e9eb58633d43a9d58a1852b6
• https://git.kernel.org/stable/c/598686f5d65b9af2223ed9d22fadba16e09f6ca8
• https://git.kernel.org/stable/c/68f0bcc4e16e31ff8dbe6ca93116eb70d7b6ac44
• https://git.kernel.org/stable/c/70b0a27bdde0cb524349c8261202c7c9393cf5e9
• https://git.kernel.org/stable/c/c1fd465ea1c5aef459f9bc3ac602b5353e0f536f
• https://git.kernel.org/stable/c/e93fad891c72deb84cae49430163b384ebcc92b1

• Incorrect authorization in Linux kernel bluetooth
• Ubuntu update for linux-oem-7.0
• Ubuntu update for linux, linux-aws, linux-gcp and more
• Ubuntu update for linux-nvidia-tegra, linux-nvidia-tegra-5.15, linux-nvidia-tegra-igx
• Ubuntu update for linux, linux-aws, linux-aws-5.15 and more