CVE-2026-98460

A flaw was found in the Linux kernel's Bluetooth subsystem. This flaw allows a local, unprivileged user to bypass security restrictions and send unauthorized commands directly to the Bluetooth hardware. The vulnerability exists because the Host Controller Interface (HCI) raw socket improperly filters command identifiers, masking out-of-range values instead of rejecting them, which causes restricted commands to be erroneously accepted as allowlisted ones.

Red Hat rates this vulnerability as Moderate impact because exploitation requires local unprivileged user execution on a host with an operational Bluetooth controller, restricting the potential blast radius. Default server deployments of Red Hat Enterprise Linux rarely utilize Bluetooth hardware, which significantly minimizes real-world risk across typical enterprise environments. While an attacker can leverage flawed HCI socket filtering to dispatch reserved opcodes, the ultimate handling of these commands is constrained by the physical controller, preventing direct privilege escalation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.