CVE-2026-98456: Software Security Vulnerability Vulnerability

UNKNOWN
Advisory Identifier: GHSA-79jp-j4mv-p57c
Share
Published
Advisory Summary

CVE-2026-98456 is a security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-98456 at a Glance

CVE Identifier CVE-2026-98456
GHSA Identifier GHSA-79jp-j4mv-p57c
Severity N/A
CVSS v3.1 Base Score N/A
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

How to Fix CVE-2026-98456

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-98456, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix race in read_unconf_index_list() read_unconf_index_list() counts unconfigured controllers before allocating its response, then checks the device flags again while filling it. hci_dev_list_lock stabilizes list membership, but it does not serialize the per-device flags. During asynchronous controller setup, the worker can set HCI_UNCONFIGURED and clear HCI_SETUP between the two passes. A controller omitted from the allocation count can then become eligible for the fill pass, causing an out-of-bounds write to rp->index[]. Allocate space for every device on hci_dev_list. Since list membership cannot change while hci_dev_list_lock is held, the response remains large enough regardless of flag transitions. The reported count and response length still include only eligible unconfigured controllers.

References

NVD — CVE-2026-98456 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-98456
git.kernel.org/stable/c/2e8bba0360... WEB
https://git.kernel.org/stable/c/2e8bba0360d1379bfa8da47c8f5dadbb10a3fba1
git.kernel.org/stable/c/416546cd6a... WEB
https://git.kernel.org/stable/c/416546cd6a54e9b68f2b91bc680b1ee17dcd77a1
git.kernel.org/stable/c/524e0450dd... WEB
https://git.kernel.org/stable/c/524e0450dd9a396f99a81b045219b0e2ea0dab57
git.kernel.org/stable/c/8ddf962c76... WEB
https://git.kernel.org/stable/c/8ddf962c76432a10a6cb80042875cbc48a9c056b
git.kernel.org/stable/c/b5dbb41b21... WEB
https://git.kernel.org/stable/c/b5dbb41b212c50c095a4dbee3017a84fe94f033b

Frequently Asked Questions

What is CVE-2026-98456?
CVE-2026-98456 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-98456?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What CWE is associated with CVE-2026-98456?
CVE-2026-98456 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-98456?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-79jp-j4mv-p57c",
  "modified" : "2026-10-18T18:31:50Z",
  "published" : "2026-10-18T18:31:49Z",
  "aliases" : [ "CVE-2026-98456" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: mgmt: fix race in read_unconf_index_list()\n\nread_unconf_index_list() counts unconfigured controllers before allocating\nits response, then checks the device flags again while filling it.\n\nhci_dev_list_lock stabilizes list membership, but it does not serialize the\nper-device flags. During asynchronous controller setup, the worker can set\nHCI_UNCONFIGURED and clear HCI_SETUP between the two passes. A controller\nomitted from the allocation count can then become eligible for the fill\npass, causing an out-of-bounds write to rp->index[].\n\nAllocate space for every device on hci_dev_list. Since list membership\ncannot change while hci_dev_list_lock is held, the response remains large\nenough regardless of flag transitions. The reported count and response\nlength still include only eligible unconfigured controllers.",
  "severity" : [ ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-98456"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/2e8bba0360d1379bfa8da47c8f5dadbb10a3fba1"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/416546cd6a54e9b68f2b91bc680b1ee17dcd77a1"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/524e0450dd9a396f99a81b045219b0e2ea0dab57"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/8ddf962c76432a10a6cb80042875cbc48a9c056b"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/b5dbb41b212c50c095a4dbee3017a84fe94f033b"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : null,
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-10-18T16:16:56Z"
  }
}