CVE-2026-98110
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2026
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
Bluetooth: btintel: bound firmware ID by TLV length
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: bound firmware ID by TLV length The firmware ID is treated as a NUL-terminated string even though the TLV length is its only boundary. If the value does not contain a NUL terminator, snprintf() can read beyond the received response. Limit the conversion to the advertised TLV value length.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Linux
- Vendor
- Linux
- Product
- Linux
- Platforms
- Unknown
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 164c62f958f8c7f0bde1e9a5a8677971c6f28205 | affected | git | aef56a2bd5aa22808ce508605d7497d2b5e8eb5f | Unavailable | None listed |
| 164c62f958f8c7f0bde1e9a5a8677971c6f28205 | affected | git | 058f56de5f48ba4b3be01526006ac83ce9e79f39 | Unavailable | None listed |
| 164c62f958f8c7f0bde1e9a5a8677971c6f28205 | affected | git | a07b3024a927892dd46e7dfbed438e8834e24098 | Unavailable | None listed |
| 164c62f958f8c7f0bde1e9a5a8677971c6f28205 | affected | git | ac8aa9e0ec93a12a60230066f199f49c3b9aac3d | Unavailable | None listed |
Linux
- Vendor
- Linux
- Product
- Linux
- Platforms
- Unknown
- Default status
affected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 6.11 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 0 | unaffected | semver | 6.11 | Unavailable | None listed |
| 6.12.111 | unaffected | semver | Unavailable | 6.12.* | None listed |
| 6.18.53 | unaffected | semver | Unavailable | 6.18.* | None listed |
| 7.2.7 | unaffected | semver | Unavailable | 7.2.* | None listed |
| 7.3 | unaffected | original_commit_for_fix | Unavailable | * | None listed |