CVE-2026-98461: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-98461 Overview

CVE-2026-98461 is an out-of-bounds read vulnerability in the Linux kernel's Bluetooth subsystem, specifically in the hci_sock HCI socket layer. The is_filtered_packet() function reads the event code from skb->data[0] without first checking that the socket buffer is nonempty. When an opcode filter is configured, the function also reads the command opcode at offsets 3 or 4 without verifying that a Command Complete or Command Status event is long enough to contain those fields. A malformed event supplied by a controller or a vhci device can trigger the out-of-bounds read before hci_event_packet() validates the event header.

Critical Impact
A malformed Bluetooth HCI event from a physical controller or virtual HCI (vhci) device can trigger kernel out-of-bounds memory reads, potentially leading to information disclosure or kernel instability.

Affected Products

Linux kernel Bluetooth subsystem (net/bluetooth/hci_sock.c)
Systems exposing the vhci virtual HCI interface
Linux distributions shipping affected stable kernel branches prior to the fix

Discovery Timeline

2026-10-18 - CVE-2026-98461 published to NVD
2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-98461

Vulnerability Analysis

The vulnerability resides in is_filtered_packet() within the Linux kernel Bluetooth HCI socket layer. The function dereferences skb->data[0] to extract the event code before confirming the socket buffer contains any payload. When userspace or an attached HCI transport configures an opcode filter, the function additionally reads bytes at offsets 3 and 4 to extract the command opcode associated with Command Complete (0x0e) or Command Status (0x0f) events, again without validating that the event payload is long enough.

Because hci_send_to_sock() invokes the filter path before hci_event_packet() performs header validation, a short or malformed event propagated from a physical controller or a vhci device reaches the vulnerable read first. The result is an out-of-bounds read of kernel memory adjacent to the socket buffer.

Root Cause

Two defects contribute to the issue. First, the filter code lacks length checks on skb->len before indexing into skb->data. Second, the code applies a mask to the event code before comparing it against command event identifiers. The masked value is needed for the 64-bit event bitmap, but using it for command identification aliases event codes above 0x3f. Synchronous Train Complete (0x4f) is incorrectly treated as Command Status (0x0f) even though its payload contains no opcode field.

Attack Vector

An attacker needs the ability to deliver a malformed HCI event into the kernel. This is possible through a malicious or buggy Bluetooth controller attached to the host, or through local access to the vhci interface, which is commonly used for testing and emulation. A truncated event or an aliased event code such as 0x4f causes is_filtered_packet() to read beyond the end of the received buffer. The patch keeps the unmasked event code for opcode comparisons and rejects command events that are too short for the field being inspected. See the upstream fixes at git.kernel.org commit 1a92763c and git.kernel.org commit f894f629.

Detection Methods for CVE-2026-98461

Indicators of Compromise

Unexpected kernel oops or KASAN reports referencing is_filtered_packet or hci_send_to_sock in net/bluetooth/hci_sock.c.
Repeated short or malformed HCI events observed on hci0 or vhci interfaces in btmon traces.
Processes with CAP_NET_ADMIN opening raw HCI sockets on hosts that do not require Bluetooth management tooling.

Detection Strategies

Enable KASAN (Kernel Address Sanitizer) on test and staging kernels to surface the out-of-bounds read reliably during fuzzing or vhci emulation.
Audit kernel logs (dmesg, journalctl -k) for Bluetooth subsystem warnings and BUG: entries referencing HCI socket handling.
Monitor for unauthorized loading of the hci_vhci module on servers and endpoints where Bluetooth is not an operational requirement.

Monitoring Recommendations

Track creation of AF_BLUETOOTH raw sockets using eBPF or auditd rules on socket(2) syscalls with family 31.
Alert on new Bluetooth adapters appearing via udev on fixed-function or server systems.
Collect kernel crash dumps and ship them to a central telemetry pipeline for triage against known Bluetooth CVEs.

How to Mitigate CVE-2026-98461

Immediate Actions Required

Apply the stable kernel updates referenced in the upstream commit series as soon as distribution packages become available.
Unload the hci_vhci kernel module on systems that do not need virtual HCI emulation using rmmod hci_vhci and blocklist it.
Disable Bluetooth on servers and infrastructure hosts that have no operational requirement for it.
Restrict CAP_NET_ADMIN to the minimum set of service accounts, since this capability is required to open raw HCI sockets.

Patch Information

The fix validates skb->len before dereferencing event payload bytes and preserves the unmasked event code for command event identification. Backports are available across multiple stable branches. See the upstream patches: commit 1a92763c, commit 2501a3b7, commit 3976bbcd, commit 39e99d85, commit b0a6cf99, commit dca25c20, commit ebdd49ce, and commit f894f629.

Workarounds

Blocklist the bluetooth, btusb, and hci_vhci modules on hosts that do not require Bluetooth connectivity.
Remove or disable physical Bluetooth adapters where feasible to eliminate the untrusted controller input path.
Use seccomp or LSM policies to prevent unprivileged processes from opening AF_BLUETOOTH raw sockets.

bash

# Blocklist Bluetooth and virtual HCI modules
echo 'blacklist bluetooth' | sudo tee /etc/modprobe.d/disable-bluetooth.conf
echo 'blacklist btusb'     | sudo tee -a /etc/modprobe.d/disable-bluetooth.conf
echo 'blacklist hci_vhci'  | sudo tee -a /etc/modprobe.d/disable-bluetooth.conf

# Unload currently loaded modules
sudo rmmod hci_vhci 2>/dev/null
sudo systemctl disable --now bluetooth.service

# Verify the modules are no longer loaded
lsmod | grep -E 'bluetooth|hci_vhci'