CVE-2026-98460

A vulnerability exists in the Linux kernel 's Bluetooth hci_sock component. The raw HCI socket security filter provides 128 OCF bits per supported OGF but masks the 10-bit OCF with 127 before command lookup. This allows an unprivileged socket to submit a reserved OCF that aliases an allowlisted c...

CVE-2026-98460 Bluetooth: hci_sock: reject out-of-range OCF values

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisock: reject out-of-range OCF values The raw HCI socket security filter has 128 OCF bits per supported OGF, but masks the 10-bit OCF with 127 before looking up the command. An unprivileged socket can therefore submi...