CVE-2026-99091

A flaw was found in the Linux kernel's Bluetooth subsystem. When pending management commands are flushed during an adapter power-off or device removal event, the kernel incorrectly reports command status values using internal memory pointer data instead of the intended error code. A local user can trigger this issue by submitting commands during adapter state changes, causing user space Bluetooth services to receive malformed responses and crash, resulting in a denial of service (DoS), or potentially exposing a byte of internal memory.

This vulnerability is rated as having a Low impact because exploitation requires local access, precise timing during adapter power-off or removal, and only affects systems with Bluetooth hardware enabled. In typical enterprise server deployments, Bluetooth is generally not present or is unconfigured. Furthermore, the consequence is limited to crashing the local userspace Bluetooth service or leaking an isolated byte of internal pointer memory, without enabling privilege escalation or system-level compromise.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.