CVE-2026-98456

A flaw was found in the Linux kernel's Bluetooth subsystem. A race condition in the read_unconf_index_list() function allows a local user to cause an out-of-bounds write during asynchronous controller setup. This issue occurs when device state flags change between response buffer sizing and data population. A local attacker can exploit this vulnerability to cause memory corruption, resulting in a system crash and Denial of Service (DoS).

This vulnerability is rated as Moderate severity for Red Hat Enterprise Linux because exploitation requires local access, specific management socket privileges, and precise timing during asynchronous controller initialization. Enterprise server and cloud deployments rarely utilize Bluetooth hardware, which significantly limits practical exposure in most production environments. In affected configurations, successfully winning the race condition can result in kernel memory corruption and a denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.