CVE-2026-98456: Bluetooth: mgmt: fix race in read_unconf_index_list()

CVE-2026-98456: Bluetooth: mgmt: fix race in read_unconf_index_list()

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: mgmt: fix race in read_unconf_index_list()

read_unconf_index_list() counts unconfigured controllers before allocating
its response, then checks the device flags again while filling it.

hci_dev_list_lock stabilizes list membership, but it does not serialize the
per-device flags. During asynchronous controller setup, the worker can set
HCI_UNCONFIGURED and clear HCI_SETUP between the two passes. A controller
omitted from the allocation count can then become eligible for the fill
pass, causing an out-of-bounds write to rp->index[].

Allocate space for every device on hci_dev_list. Since list membership
cannot change while hci_dev_list_lock is held, the response remains large
enough regardless of flag transitions. The reported count and response
length still include only eligible unconfigured controllers.

The Linux kernel CVE team has assigned CVE-2026-98456 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 3.17 with commit 73d1df2a7a1036a1f000e5f0ece6ade3e082b854 and fixed in 6.6.158 with commit 524e0450dd9a396f99a81b045219b0e2ea0dab57
	Issue introduced in 3.17 with commit 73d1df2a7a1036a1f000e5f0ece6ade3e082b854 and fixed in 6.12.112 with commit 8ddf962c76432a10a6cb80042875cbc48a9c056b
	Issue introduced in 3.17 with commit 73d1df2a7a1036a1f000e5f0ece6ade3e082b854 and fixed in 6.18.55 with commit 416546cd6a54e9b68f2b91bc680b1ee17dcd77a1
	Issue introduced in 3.17 with commit 73d1df2a7a1036a1f000e5f0ece6ade3e082b854 and fixed in 7.2.9 with commit 2e8bba0360d1379bfa8da47c8f5dadbb10a3fba1
	Issue introduced in 3.17 with commit 73d1df2a7a1036a1f000e5f0ece6ade3e082b854 and fixed in 7.3-rc5 with commit b5dbb41b212c50c095a4dbee3017a84fe94f033b

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-98456
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/bluetooth/mgmt.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/524e0450dd9a396f99a81b045219b0e2ea0dab57
	https://git.kernel.org/stable/c/8ddf962c76432a10a6cb80042875cbc48a9c056b
	https://git.kernel.org/stable/c/416546cd6a54e9b68f2b91bc680b1ee17dcd77a1
	https://git.kernel.org/stable/c/2e8bba0360d1379bfa8da47c8f5dadbb10a3fba1
	https://git.kernel.org/stable/c/b5dbb41b212c50c095a4dbee3017a84fe94f033b