In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sock: validate event length before filtering is_filtered_packet()… (CVE-2026-98461)

The Linux kernel Bluetooth vulnerability (CVE-2026-98461) involves the is_filtered_packet() function reading event codes from skb->data without verifying the buffer length, causing out-of-bounds reads when opcode filters are applied. Specifically, command opcodes at offsets 3 or 4 are accessed without length checks. The filtering occurs before event header validation, allowing malformed events from controllers or vhci devices to trigger the flaw. The fix includes rejecting truncated command events and correcting event code masking to avoid aliasing event codes, ensuring only valid events are processed.

This vulnerability can cause out-of-bounds reads in kernel memory when processing malformed Bluetooth events, potentially leading to kernel crashes or information disclosure. However, no known exploits are reported in the wild. The impact is limited to systems with Bluetooth enabled and configured with opcode filters.

A fix has been implemented in the Linux kernel to validate event lengths before filtering and to reject truncated command events. Users should update to the fixed Linux kernel version once available. Patch status is not explicitly stated in the provided data; therefore, check the vendor advisory for current remediation guidance.