CVE-2026-98247

A flaw was found in the Linux kernel's Bluetooth subsystem. When processing responses for supported codecs, the parser fails to verify that adequate buffer space remains before reading the vendor codec count. A malicious or malfunctioning Bluetooth controller can supply a truncated response packet, triggering an out-of-bounds memory read. This issue primarily results in a system crash, leading to a Denial of Service (DoS), or may potentially expose kernel memory.

This vulnerability is rated as Moderate severity for Red Hat Enterprise Linux because exploitation requires access to a rogue or compromised Bluetooth controller directly attached to the host, preventing unauthenticated remote attacks over the network. In standard enterprise server and cloud deployments, Bluetooth hardware interfaces are rarely present or active by default. The primary risk is confined to systems with physical Bluetooth adapters or virtualized environments configured with Bluetooth device passthrough, where malformed controller replies can cause a kernel crash or information leak.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.