AZL-109296
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-109296.json
- JSON Data
- https://api.osv.dev/v1/vulns/AZL-109296
- Upstream
- Published
- 2026-10-18T16:16:56Z
- Modified
- 2026-10-19T14:17:06Z
- Summary
- CVE-2026-98460 affecting package kernel 6.6.157.1-1
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hci_sock: reject out-of-range OCF values
The raw HCI socket security filter has 128 OCF bits per supported OGF, but masks the 10-bit OCF with 127 before looking up the command. An unprivileged socket can therefore submit a reserved OCF that aliases an allowlisted command modulo 128.
A conforming controller should reject reserved opcodes. Nevertheless, the security decision must apply to the opcode that will actually be sent, especially since controller-specific behavior is outside the host stack's control.
Reject OCF values that cannot be represented by the security filter instead of aliasing them onto an unrelated command.
- References