CVE-2026-98247

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98247", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.330Z", "datePublished": "2026-10-06T08:45:16.048Z", "dateUpdated": "2026-10-19T09:16:18.761Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:16:18.761Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_codec: validate vendor codec count length\n\nThe Read Local Supported Codecs parsers consume the variable-sized\nstandard codec array before parsing the vendor codec count. Although the\ninitial reply-size check includes a vendor count byte in the fixed layout,\nit does not guarantee that the byte remains after the standard codec array.\n\nIf a controller reply ends immediately after that array, calculating the\nvendor codec array size reads vnd_codecs->num beyond the skb data. Use\nskb_pull_data() to validate and consume each codec header before using its\ncount in both command variants."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/bluetooth/hci_codec.c"], "versions": [{"version": "8961987f3f5fa2f2618e72304d013c8dd5e604a6", "lessThan": "9c04b9a4d08b95dee901d24b7607c4cbd65fa0a8", "status": "affected", "versionType": "git"}, {"version": "8961987f3f5fa2f2618e72304d013c8dd5e604a6", "lessThan": "a6da782fefae611e68a1aa79644065fc8ca5abcd", "status": "affected", "versionType": "git"}, {"version": "8961987f3f5fa2f2618e72304d013c8dd5e604a6", "lessThan": "e4cfd3c4299105237458b27958bd7b0aa4c60795", "status": "affected", "versionType": "git"}, {"version": "8961987f3f5fa2f2618e72304d013c8dd5e604a6", "lessThan": "f49a543d76d48f184b34225d9c0e2fc4cbdea8ec", "status": "affected", "versionType": "git"}, {"version": "8961987f3f5fa2f2618e72304d013c8dd5e604a6", "lessThan": "12a82819b0cada6e304790b1097f8f9006eb6123", "status": "affected", "versionType": "git"}, {"version": "8961987f3f5fa2f2618e72304d013c8dd5e604a6", "lessThan": "d0795cfd6f655f4de84868a4f4bb41a03f037b3d", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/bluetooth/hci_codec.c"], "versions": [{"version": "5.16", "status": "affected"}, {"version": "0", "lessThan": "5.16", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.189", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.158", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.112", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.54", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.8", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.1.189"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.6.158"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.12.112"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.18.54"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "7.2.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/9c04b9a4d08b95dee901d24b7607c4cbd65fa0a8"}, {"url": "https://git.kernel.org/stable/c/a6da782fefae611e68a1aa79644065fc8ca5abcd"}, {"url": "https://git.kernel.org/stable/c/e4cfd3c4299105237458b27958bd7b0aa4c60795"}, {"url": "https://git.kernel.org/stable/c/f49a543d76d48f184b34225d9c0e2fc4cbdea8ec"}, {"url": "https://git.kernel.org/stable/c/12a82819b0cada6e304790b1097f8f9006eb6123"}, {"url": "https://git.kernel.org/stable/c/d0795cfd6f655f4de84868a4f4bb41a03f037b3d"}], "title": "Bluetooth: hci_codec: validate vendor codec count length", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/bluetooth/hci_codec.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "9c04b9a4d08b95dee901d24b7607c4cbd65fa0a8", "status": "affected", "version": "8961987f3f5fa2f2618e72304d013c8dd5e604a6", "versionType": "git"}, {"lessThan": "a6da782fefae611e68a1aa79644065fc8ca5abcd", "status": "affected", "version": "8961987f3f5fa2f2618e72304d013c8dd5e604a6", "versionType": "git"}, {"lessThan": "e4cfd3c4299105237458b27958bd7b0aa4c60795", "status": "affected", "version": "8961987f3f5fa2f2618e72304d013c8dd5e604a6", "versionType": "git"}, {"lessThan": "f49a543d76d48f184b34225d9c0e2fc4cbdea8ec", "status": "affected", "version": "8961987f3f5fa2f2618e72304d013c8dd5e604a6", "versionType": "git"}, {"lessThan": "12a82819b0cada6e304790b1097f8f9006eb6123", "status": "affected", "version": "8961987f3f5fa2f2618e72304d013c8dd5e604a6", "versionType": "git"}, {"lessThan": "d0795cfd6f655f4de84868a4f4bb41a03f037b3d", "status": "affected", "version": "8961987f3f5fa2f2618e72304d013c8dd5e604a6", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/bluetooth/hci_codec.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.16"}, {"lessThan": "5.16", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.189", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.158", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.112", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.54", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.8", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_codec: validate vendor codec count length\n\nThe Read Local Supported Codecs parsers consume the variable-sized\nstandard codec array before parsing the vendor codec count. Although the\ninitial reply-size check includes a vendor count byte in the fixed layout,\nit does not guarantee that the byte remains after the standard codec array.\n\nIf a controller reply ends immediately after that array, calculating the\nvendor codec array size reads vnd_codecs->num beyond the skb data. Use\nskb_pull_data() to validate and consume each codec header before using its\ncount in both command variants."}], "id": "CVE-2026-98247", "lastModified": "2026-10-19T10:18:25.610", "metrics": {}, "published": "2026-10-06T09:18:12.940", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/12a82819b0cada6e304790b1097f8f9006eb6123"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9c04b9a4d08b95dee901d24b7607c4cbd65fa0a8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a6da782fefae611e68a1aa79644065fc8ca5abcd"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d0795cfd6f655f4de84868a4f4bb41a03f037b3d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e4cfd3c4299105237458b27958bd7b0aa4c60795"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f49a543d76d48f184b34225d9c0e2fc4cbdea8ec"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: Bluetooth: hci_codec: validate vendor codec count length", "id": "2546456", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2546456"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nBluetooth: hci_codec: validate vendor codec count length\nThe Read Local Supported Codecs parsers consume the variable-sized\nstandard codec array before parsing the vendor codec count. Although the\ninitial reply-size check includes a vendor count byte in the fixed layout,\nit does not guarantee that the byte remains after the standard codec array.\nIf a controller reply ends immediately after that array, calculating the\nvendor codec array size reads vnd_codecs->num beyond the skb data. Use\nskb_pull_data() to validate and consume each codec header before using its\ncount in both command variants.", "A flaw was found in the Linux kernel's Bluetooth subsystem. When processing responses for supported codecs, the parser fails to verify that adequate buffer space remains before reading the vendor codec count. A malicious or malfunctioning Bluetooth controller can supply a truncated response packet, triggering an out-of-bounds memory read. This issue primarily results in a system crash, leading to a Denial of Service (DoS), or may potentially expose kernel memory."], "name": "CVE-2026-98247", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-06T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98247\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98247\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98247.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8961987f3f5fa2f2618e72304d013c8dd5e604a6,9c04b9a4d08b95dee901d24b7607c4cbd65fa0a8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8961987f3f5fa2f2618e72304d013c8dd5e604a6,a6da782fefae611e68a1aa79644065fc8ca5abcd)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8961987f3f5fa2f2618e72304d013c8dd5e604a6,e4cfd3c4299105237458b27958bd7b0aa4c60795)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8961987f3f5fa2f2618e72304d013c8dd5e604a6,f49a543d76d48f184b34225d9c0e2fc4cbdea8ec)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8961987f3f5fa2f2618e72304d013c8dd5e604a6,12a82819b0cada6e304790b1097f8f9006eb6123)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8961987f3f5fa2f2618e72304d013c8dd5e604a6,d0795cfd6f655f4de84868a4f4bb41a03f037b3d)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.16"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,5.16)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.189,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.158,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.112,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.54,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.8,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc4,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-06T14:45:18.429383+00:00", "updated": "2026-10-11T15:00:12.828002+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-20", "CWE-787", "CWE-125"]}