CVE-2026-98461
En el kernel de Linux se ha resuelto la siguiente vulnerabilidad:
Bluetooth: hci_sock: validar la longitud del evento antes de filtrar
is_filtered_packet() lee el código del evento desde skb->data[0] sin comprobar antes que el skb no esté vacío. Cuando hay configurado un filtro de opcodes, también lee el opcode del comando en los desplazamientos 3 o 4 sin comprobar que un evento Command Complete o Command Status tenga la longitud suficiente.
hci_send_to_sock() invoca el filtro antes de que hci_event_packet() valide la cabecera del evento. Por tanto, un evento malformado proporcionado por un controlador o por un dispositivo vhci puede provocar una lectura fuera de límites.
Leer descripción completaMostrar menos
Mantener el código de evento sin enmascarar para las comprobaciones de opcode. El valor enmascarado es necesario para el mapa de bits de eventos de 64 bits, pero usarlo para identificar eventos de comando provoca alias con los códigos de evento superiores a 0x3f. En concreto, Synchronous Train Complete (0x4f) se trataba como Command Status (0x0f), aunque su carga útil no tiene opcode.
Rechazar los eventos de comando reales que sean demasiado cortos para el campo que se inspecciona. Un evento de comando truncado no puede coincidir con un opcode configurado.
Traducción automática del texto original de NVD (en inglés).
CVSS
NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días
- 0.21 %
- Percentil entre todas las CVEs puntuadas
- 11
- Fecha de la puntuación
- 20/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.
Referencias
Mostrar las 8 referencias
- https://git.kernel.org/stable/c/1a92763c2ba721bf113cd83f913fe8c511b4a4dc
- https://git.kernel.org/stable/c/2501a3b7b7144d1d11939b355a48ed01f83d0c62
- https://git.kernel.org/stable/c/3976bbcd43b9b94c53ac9b0fd28888011588f4cc
- https://git.kernel.org/stable/c/39e99d85071bca0feeec3164a9437ca1bff297fc
- https://git.kernel.org/stable/c/b0a6cf99afd57a39598b1beca0e86ef5004980de
- https://git.kernel.org/stable/c/dca25c204f71be0556a15177dbe037237ac43e5e
- https://git.kernel.org/stable/c/ebdd49cec380731844ed9df4092a29a014623df4
- https://git.kernel.org/stable/c/f894f6292d5122cd62d30600736b4a0ae79f7770
JSON original (NVD)
Mostrar
{
"id": "CVE-2026-98461",
"cveTags": [],
"metrics": {},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"lessThan": "39e99d85071bca0feeec3164a9437ca1bff297fc",
"versionType": "git"
},
{
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"lessThan": "ebdd49cec380731844ed9df4092a29a014623df4",
"versionType": "git"
},
{
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"lessThan": "2501a3b7b7144d1d11939b355a48ed01f83d0c62",
"versionType": "git"
},
{
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"lessThan": "dca25c204f71be0556a15177dbe037237ac43e5e",
"versionType": "git"
},
{
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"lessThan": "3976bbcd43b9b94c53ac9b0fd28888011588f4cc",
"versionType": "git"
},
{
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"lessThan": "f894f6292d5122cd62d30600736b4a0ae79f7770",
"versionType": "git"
},
{
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"lessThan": "1a92763c2ba721bf113cd83f913fe8c511b4a4dc",
"versionType": "git"
},
{
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"lessThan": "b0a6cf99afd57a39598b1beca0e86ef5004980de",
"versionType": "git"
}
],
"programFiles": [
"net/bluetooth/hci_sock.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "2.6.12",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.55",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.9",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"net/bluetooth/hci_sock.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2026-10-18T16:16:56.543",
"references": [
{
"url": "https://git.kernel.org/stable/c/1a92763c2ba721bf113cd83f913fe8c511b4a4dc",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/2501a3b7b7144d1d11939b355a48ed01f83d0c62",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/3976bbcd43b9b94c53ac9b0fd28888011588f4cc",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/39e99d85071bca0feeec3164a9437ca1bff297fc",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/b0a6cf99afd57a39598b1beca0e86ef5004980de",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/dca25c204f71be0556a15177dbe037237ac43e5e",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/ebdd49cec380731844ed9df4092a29a014623df4",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/f894f6292d5122cd62d30600736b4a0ae79f7770",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sock: validate event length before filtering\n\nis_filtered_packet() reads the event code from skb->data[0] without first\nchecking that the skb is nonempty. When an opcode filter is configured,\nit also reads the command opcode at offsets 3 or 4 without checking that\na Command Complete or Command Status event is long enough.\n\nhci_send_to_sock() invokes the filter before hci_event_packet() validates\nthe event header. A malformed event supplied by a controller or a vhci\ndevice can therefore cause an out-of-bounds read.\n\nKeep the unmasked event code for the opcode checks. The masked value is\nneeded for the 64-bit event bitmap, but using it to identify command events\naliases event codes above 0x3f. In particular, Synchronous Train Complete\n(0x4f) was treated as Command Status (0x0f) even though its payload has no\nopcode.\n\nReject actual command events that are too short for the field being\ninspected. A truncated command event cannot match a configured opcode."
}
],
"lastModified": "2026-10-19T10:18:55.667",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}