{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-99091 in the wild and no public exploit code.","fix":"Upgrade to a fixed version.","what":"CVE-2026-99091 is a vulnerability in Linux, published on 26 Oct 2026."},"fix_prompt":"Check this codebase for CVE-2026-99091 and fix it if it is affected.\n\nWhat it is: CVE-2026-99091 is a vulnerability in Linux, published on 26 Oct 2026. \nExploitation: There is no known exploitation of CVE-2026-99091 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-99091/ (Markdown: https://insights.sbomify.com/CVE-2026-99091/index.md)","id":"CVE-2026-99091","markdown":"https://insights.sbomify.com/CVE-2026-99091/index.md","name":"CVE-2026-99091","record":{"aliases":["BELL-CVE-2026-99091","DEBIAN-CVE-2026-99091","GHSA-75m9-vh6c-66mx","UBUNTU-CVE-2026-99091"],"analysis":null,"analysis_generated_by":null,"assigner":"Linux","cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: MGMT: Fix status of pending commands flushed on power off\n\ncmd_complete_rsp() receives a struct cmd_lookup and, for a pending\ncommand that has no cmd_complete callback, falls through to\ncmd_status_rsp(cmd, data). cmd_status_rsp() reads data as a u8 *, so\nthe status sent comes from the first byte of match-\u003esk's\nrepresentation, not from match-\u003emgmt_status.\n\ncommit f53e1c9c726d (\"Bluetooth: MGMT: Fix possible crash on\nmgmt_index_removed\") changed the callers' data from \u0026status to \u0026match\nand updated the cmd_complete branch to match-\u003emgmt_status, but left\nthe fall-through passing data unchanged.\n\nIn mgmt_index_removed() match-\u003esk is NULL, so every such command is\nanswered with status 0x00 (Success) instead of\nMGMT_STATUS_INVALID_INDEX. In __mgmt_power_off() it is NULL too,\nunless a Set Powered command was pending: then settings_rsp() has\nstored that command's socket in match-\u003esk, and the byte sent comes\nfrom the socket pointer. Either way the status the caller set,\nMGMT_STATUS_NOT_POWERED (or MGMT_STATUS_INVALID_INDEX when the device\nis being unregistered), is lost.\n\nPass the status the callers set.\n\nThis was seen on a QCA9377 laptop: bluetoothd's Start Discovery,\npending when the adapter was powered off, was answered with Command\nStatus 0x00 and no parameters, and bluetoothd 5.72 crashed on the\nzero-length success. BlueZ master has since added the length check\non that path (\"adapter: Fix crash on short start discovery reply\",\nBlueZ a734b06059cb), but userspace should still be told Not Powered,\nnot Success.\n\nTested on Ubuntu 7.0.0-31 with a virtual controller (hci_vhci):\npower off is held in HCI Write Scan Enable while a Start Discovery is\nsubmitted, and the flush answers it with status 0x00 before this\nchange and 0x0f (Not Powered) after.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Bluetooth: MGMT: Fix status of pending commands flushed on power off","id":"CVE-2026-99091","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":null,"year":"2026"},"n_packages":0,"n_references":5,"next":{"headline":"riscv: patch: fix handling of bpf-jit execmem addresses","id":"CVE-2026-99092"},"packages":[],"prev":{"headline":"drm/amdgpu: serialize vblank counter reads against GPU reset","id":"CVE-2026-99090"},"products":["Linux"],"published":"2026-10-26","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-10-26","vendors":["Linux"]},"summary":null,"url":"https://insights.sbomify.com/CVE-2026-99091/"}