In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix race in read_unconf_index_list() read_unconf_index_list()… (CVE-2026-98456)

The vulnerability in the Linux kernel Bluetooth management code arises from a race condition in read_unconf_index_list(). This function first counts unconfigured controllers to allocate response space, then rechecks device flags while filling the response. Because hci_dev_list_lock only stabilizes list membership but does not serialize per-device flags, asynchronous controller setup can change flags between counting and filling passes. This leads to a controller being omitted from the allocation count but included in the fill pass, causing an out-of-bounds write to the response index array. The patch fixes this by allocating space for every device on the hci_dev_list, ensuring the response buffer is always large enough regardless of flag transitions, while still reporting counts only for eligible unconfigured controllers.

The vulnerability could cause an out-of-bounds write in kernel memory during Bluetooth controller enumeration, potentially leading to memory corruption or system instability. No known exploits in the wild have been reported. The impact is limited to systems running the affected Linux kernel Bluetooth management code during asynchronous controller setup.

A fix has been implemented in the Linux kernel to address this race condition by changing the allocation strategy in read_unconf_index_list(). Users should apply the official Linux kernel updates that include this patch to remediate the vulnerability. Since this is a kernel-level issue, updating to a patched kernel version is the recommended mitigation.