# CVE-2026-99091: Bluetooth: MGMT: Fix status of pending commands flushed on power off


- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Fix available:** Yes
- **Published:** 26 Oct 2026
- **Updated:** 26 Oct 2026
- **Also known as:** BELL-CVE-2026-99091, DEBIAN-CVE-2026-99091, GHSA-75m9-vh6c-66mx, UBUNTU-CVE-2026-99091

## What is CVE-2026-99091?

CVE-2026-99091 is a vulnerability in Linux, published on 26 Oct 2026. 

### Official description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: MGMT: Fix status of pending commands flushed on power off

cmd_complete_rsp() receives a struct cmd_lookup and, for a pending
command that has no cmd_complete callback, falls through to
cmd_status_rsp(cmd, data). cmd_status_rsp() reads data as a u8 *, so
the status sent comes from the first byte of match->sk's
representation, not from match->mgmt_status.

commit f53e1c9c726d ("Bluetooth: MGMT: Fix possible crash on
mgmt_index_removed") changed the callers' data from &status to &match
and updated the cmd_complete branch to match->mgmt_status, but left
the fall-through passing data unchanged.

In mgmt_index_removed() match->sk is NULL, so every such command is
answered with status 0x00 (Success) instead of
MGMT_STATUS_INVALID_INDEX. In __mgmt_power_off() it is NULL too,
unless a Set Powered command was pending: then settings_rsp() has
stored that command's socket in match->sk, and the byte sent comes
from the socket pointer. Either way the status the caller set,
MGMT_STATUS_NOT_POWERED (or MGMT_STATUS_INVALID_INDEX when the device
is being unregistered), is lost.

Pass the status the callers set.

This was seen on a QCA9377 laptop: bluetoothd's Start Discovery,
pending when the adapter was powered off, was answered with Command
Status 0x00 and no parameters, and bluetoothd 5.72 crashed on the
zero-length success. BlueZ master has since added the length check
on that path ("adapter: Fix crash on short start discovery reply",
BlueZ a734b06059cb), but userspace should still be told Not Powered,
not Success.

Tested on Ubuntu 7.0.0-31 with a virtual controller (hci_vhci):
power off is held in HCI Write Scan Enable while a Start Discovery is
submitted, and the flush answers it with status 0x00 before this
change and 0x0f (Not Powered) after.

## Which versions are affected by CVE-2026-99091?


## How do I fix CVE-2026-99091?

Upgrade to a fixed version.

## Is CVE-2026-99091 being exploited?

There is no known exploitation of CVE-2026-99091 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-99091 and fix it if it is affected.

What it is: CVE-2026-99091 is a vulnerability in Linux, published on 26 Oct 2026. 
Exploitation: There is no known exploitation of CVE-2026-99091 in the wild and no public exploit code.

Affected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-99091/ (Markdown: https://insights.sbomify.com/CVE-2026-99091/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-99091
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-99091
- OSV: https://osv.dev/vulnerability/CVE-2026-99091

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-99091/
Summaries are generated and may contain mistakes; the official description above is the record.