CVE-2026-98461

The Linux kernel contains a vulnerability in the Bluetooth subsystem within the hci_sock component. The is_filtered_packet() function performs an out-of-bounds read by accessing skb->data[0] without verifying the socket buffer is non-empty. Additionally, when an opcode filter is active, it rea...

EUVD-2026-103701

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisock: validate event length before filtering isfilteredpacket reads the event code from skb-data0 without first checking that the skb is nonempty. When an opcode filter is configured, it also reads the command opcod...

CVE-2026-98461 Bluetooth: hci_sock: validate event length before filtering

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisock: validate event length before filtering isfilteredpacket reads the event code from skb-data0 without first checking that the skb is nonempty. When an opcode filter is configured, it also reads the command opcod...