CVE-2026-99091— Bluetooth: MGMT: Fix status of pending commands flushed on power off

Quick assessment

Affected

Linux Linux

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，以下漏洞已得到修复：蓝牙：MGMT：修复电源关闭时已挂起命令的状态报告问题函数接收一个结构体。对于没有回调的挂起命令，代码会落入分支。将参数视为类型进行读取，因此返回的状态值取自结构表示的第一个字节，而非预期的字段。提交 f53e1c9c726d（"Bluetooth: MGMT: Fix possible crash on mgmt_index_removed"）将调用方传入的参数从改为，并更新了分支以使用，但却遗漏了对落入分支的参数进行相应更新。在

AI Predicted 5.5 Difficulty: Moderate Updated Oct 26, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Updated Oct 26, 2026

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Bluetooth: MGMT: Fix status of pending commands flushed on power off

Source: CVE Program / CVE List V5

Vulnerability Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix status of pending commands flushed on power off cmd_complete_rsp() receives a struct cmd_lookup and, for a pending command that has no cmd_complete callback, falls through to cmd_status_rsp(cmd, data). cmd_status_rsp() reads data as a u8 *, so the status sent comes from the first byte of match->sk's representation, not from match->mgmt_status. commit f53e1c9c726d ("Bluetooth: MGMT: Fix possible crash on mgmt_index_removed") changed the callers' data from &status to &match and updated the cmd_complete branch to match->mgmt_status, but left the fall-through passing data unchanged. In mgmt_index_removed() match->sk is NULL, so every such command is answered with status 0x00 (Success) instead of MGMT_STATUS_INVALID_INDEX. In __mgmt_power_off() it is NULL too, unless a Set Powered command was pending: then settings_rsp() has stored that command's socket in match->sk, and the byte sent comes from the socket pointer. Either way the status the caller set, MGMT_STATUS_NOT_POWERED (or MGMT_STATUS_INVALID_INDEX when the device is being unregistered), is lost. Pass the status the callers set. This was seen on a QCA9377 laptop: bluetoothd's Start Discovery, pending when the adapter was powered off, was answered with Command Status 0x00 and no parameters, and bluetoothd 5.72 crashed on the zero-length success. BlueZ master has since added the length check on that path ("adapter: Fix crash on short start discovery reply", BlueZ a734b06059cb), but userspace should still be told Not Powered, not Success. Tested on Ubuntu 7.0.0-31 with a virtual controller (hci_vhci): power off is held in HCI Write Scan Enable while a Start Discovery is submitted, and the flush answers it with status 0x00 before this change and 0x0f (Not Powered) after.

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

N/A

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Linux	Linux	4883296505aa7e4863c6869b689afb6005633b23 ~ 44ce36c5789ac84e65de1e98c32db9a5ac04ed47	-
Linux	Linux	6.12	-

II. Public POCs for CVE-2026-99091

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-99091

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-99091 (5)

https://www.cve.org/CVERecord?id=CVE-2026-99091

Same Patch Batch · Linux · 2026-10-26 · 12 CVEs total

CVE-2026-99099		x86/CPU/AMD: Fix AMD TLBI Erratum #1718
CVE-2026-99097		tee: shm: reject zero-sized allocations in tee_dyn_shm_alloc_helper()
CVE-2026-99098		dm-integrity: fix buffer overflow in inline mode with large tag size
CVE-2026-99095		drm/vc4: drain the hangcheck timer and works on V3D unbind
CVE-2026-99096		io_uring/register: don't exempt disabled rings from task restrictions
CVE-2026-99094		Bluetooth: btintel_pcie: fix TX descriptor bounds check
CVE-2026-99093		mm: don't schedule deferred kernel page table freeing while booting
CVE-2026-99092		riscv: patch: fix handling of bpf-jit execmem addresses
CVE-2026-99090		drm/amdgpu: serialize vblank counter reads against GPU reset
CVE-2026-99089		ASoC: samsung: i2s: enable op_clk in probe to balance runtime PM
CVE-2026-99088		net: openvswitch: validate transport header presence in set_ipv6_addr

IV. Related Vulnerabilities

Same product: Linux

Same vendor: Linux