Return of Wrong Status Code in Linux kernel - CVE-2026-99091
Published: October 26, 2026
Vulnerability details
The vulnerability allows a local user to cause a denial of service in Bluetooth management clients that mishandle incorrectly reported command success.
The vulnerability exists due to incorrect status propagation in the Linux kernel Bluetooth management function cmd_complete_rsp() when pending commands are flushed during adapter power-off or removal. A local user can trigger these conditions while a command without a completion callback is pending to cause the socket pointer's first byte to be returned as the command status instead of the intended error status. An incorrect success response with no parameters can crash affected clients, as observed with bluetoothd 5.72 handling a pending Start Discovery command.
Affected software
How to mitigate CVE-2026-99091
External References
- https://git.kernel.org/stable/c/07976405a3c71253e50533ee7b7a8b0dc16ab6ba
- https://git.kernel.org/stable/c/44ce36c5789ac84e65de1e98c32db9a5ac04ed47
- https://git.kernel.org/stable/c/7ed7e038b520cf0dfa12d61c2caddb95e2f6922d
- https://git.kernel.org/stable/c/86ef0f58bdecdedb3a1240971c56d71b7e4ce3fc
- https://git.kernel.org/stable/c/ec227cddd13cd7ac9077d263a73473ac370a055d