CVE-2026-98111
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2026
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
Bluetooth: btintel: validate version TLV value lengths
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: validate version TLV value lengths btintel_parse_version_tlv() verifies that a complete TLV is present in the response, but it does not ensure that the value is long enough for the specific TLV type. A short value can therefore cause an out-of-bounds read through get_unaligned_le16(), get_unaligned_le32(), or memcpy(). Reject values shorter than the minimum required by each known TLV type. Also reject responses that do not contain the Command Complete Status field.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Linux
- Vendor
- Linux
- Product
- Linux
- Platforms
- Unknown
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 57375beef71af9f245e88357fa71d9600650cb7d | affected | git | e9cf7f175c00d36b060828f4eac8d2e246ee079b | Unavailable | None listed |
| 57375beef71af9f245e88357fa71d9600650cb7d | affected | git | 83499ac3ca62e43ed40f7574b13ed398a6891511 | Unavailable | None listed |
| 57375beef71af9f245e88357fa71d9600650cb7d | affected | git | 76948d207d0978a613ce06a05cba07284a5578a7 | Unavailable | None listed |
| 57375beef71af9f245e88357fa71d9600650cb7d | affected | git | 5ec43df2830b73e004147303bf7914ca884d6770 | Unavailable | None listed |
| 57375beef71af9f245e88357fa71d9600650cb7d | affected | git | a086c0892969bf8a0151b0f12bd14a68827c88b2 | Unavailable | None listed |
Linux
- Vendor
- Linux
- Product
- Linux
- Platforms
- Unknown
- Default status
affected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 5.10 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 0 | unaffected | semver | 5.10 | Unavailable | None listed |
| 6.6.158 | unaffected | semver | Unavailable | 6.6.* | None listed |
| 6.12.111 | unaffected | semver | Unavailable | 6.12.* | None listed |
| 6.18.53 | unaffected | semver | Unavailable | 6.18.* | None listed |
| 7.2.7 | unaffected | semver | Unavailable | 7.2.* | None listed |
| 7.3 | unaffected | original_commit_for_fix | Unavailable | * | None listed |