Linux Kernel Bluetooth Vulnerability in Command Handling

CVE-2026-99091

What is CVE-2026-99091?

A vulnerability exists in the Linux kernel's Bluetooth stack where status responses for pending commands can be mishandled when the adapter is powered off. Specifically, a command that lacks a complete callback improperly returns a success status instead of indicating an invalid index or not powered state. This flaw can lead to userspace crashes, as observed with bluetoothd during a Start Discovery operation, resulting in incorrect command responses and potential system instability.

References