Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2026-98247

Bluetooth: hci_codec: validate vendor codec count length

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_codec: validate vendor codec count length The Read Local Supported Codecs parsers consume the variable-sized standard codec array before parsing the vendor codec count. Although the initial reply-size check includes a vendor count byte in the fixed layout, it does not guarantee that the byte remains after the standard codec array. If a controller reply ends immediately after that array, calculating the vendor codec array size reads vnd_codecs->num beyond the skb data. Use skb_pull_data() to validate and consume each codec header before using its count in both command variants.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 8961987f3f5fa2f2618e72304d013c8dd5e604a6 to < 9c04b9a4d08b95dee901d24b7607c4cbd65fa0a8affected
  • 8961987f3f5fa2f2618e72304d013c8dd5e604a6 to < a6da782fefae611e68a1aa79644065fc8ca5abcdaffected
  • 8961987f3f5fa2f2618e72304d013c8dd5e604a6 to < e4cfd3c4299105237458b27958bd7b0aa4c60795affected
  • 8961987f3f5fa2f2618e72304d013c8dd5e604a6 to < f49a543d76d48f184b34225d9c0e2fc4cbdea8ecaffected
  • 8961987f3f5fa2f2618e72304d013c8dd5e604a6 to < 12a82819b0cada6e304790b1097f8f9006eb6123affected
  • 8961987f3f5fa2f2618e72304d013c8dd5e604a6 to < d0795cfd6f655f4de84868a4f4bb41a03f037b3daffected

Linux Linux

Default version status: affected

  • 5.16affected
  • 0 to < 5.16unaffected
  • 6.1.189 to ≤ 6.1.*unaffected
  • 6.6.158 to ≤ 6.6.*unaffected
  • 6.12.112 to ≤ 6.12.*unaffected
  • 6.18.54 to ≤ 6.18.*unaffected
  • 7.2.8 to ≤ 7.2.*unaffected
  • 7.3 to ≤ *unaffected

References