CVE-2026-99091
Description
A flaw was found in the Linux kernel's Bluetooth subsystem. When pending management commands are flushed during an adapter power-off or device removal event, the kernel incorrectly reports command status values using internal memory pointer data instead of the intended error code. A local user can trigger this issue by submitting commands during adapter state changes, causing user space Bluetooth services to receive malformed responses and crash, resulting in a denial of service (DoS), or potentially exposing a byte of internal memory.
Statement
This vulnerability is rated as having a Low impact because exploitation requires local access, precise timing during adapter power-off or removal, and only affects systems with Bluetooth hardware enabled. In typical enterprise server deployments, Bluetooth is generally not present or is unconfigured. Furthermore, the consequence is limited to crashing the local userspace Bluetooth service or leaking an isolated byte of internal pointer memory, without enabling privilege escalation or system-level compromise.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 3.6 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | High | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | Low | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | Low | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L
Understanding the Weakness (CWE)
Other
Technical Impact: Varies by Context
When the product accesses the resource using an incompatible type, this could trigger logical errors because the resource does not have expected properties.
Availability,Integrity,Confidentiality
Technical Impact: Read Memory; Modify Memory; Execute Unauthorized Code or Commands; DoS: Crash, Exit, or Restart
If a memory buffer is accessed using an incompatible type, and the allocated buffer is smaller than the type that the code is attempting to access, then an attacker could read or write memory outside the bounds of the buffer, leading to a crash or possibly code execution.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
