{"id":"AZL-108825","summary":"CVE-2026-98456 affecting package kernel 6.6.157.1-1","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: mgmt: fix race in read_unconf_index_list()\n\nread_unconf_index_list() counts unconfigured controllers before allocating\nits response, then checks the device flags again while filling it.\n\nhci_dev_list_lock stabilizes list membership, but it does not serialize the\nper-device flags. During asynchronous controller setup, the worker can set\nHCI_UNCONFIGURED and clear HCI_SETUP between the two passes. A controller\nomitted from the allocation count can then become eligible for the fill\npass, causing an out-of-bounds write to rp-\u003eindex[].\n\nAllocate space for every device on hci_dev_list. Since list membership\ncannot change while hci_dev_list_lock is held, the response remains large\nenough regardless of flag transitions. The reported count and response\nlength still include only eligible unconfigured controllers.","modified":"2026-10-19T14:16:49.265725460Z","published":"2026-10-18T16:16:56Z","upstream":["CVE-2026-98456"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98456"}],"affected":[{"package":{"name":"kernel","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/kernel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.6.157.1-1"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-108825.json"}}],"schema_version":"1.9.0"}