CVE-2026-97907

Summary

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btrtl: Don't leak return code when parsing firmware format v2

When key_id from chip is zero, rtlbt_parse_firmware_v2() intentionally ignores all security headers. However, the implementation simply breaks from a switch statement and leaks uninitialized return code rc' (if the first section is a security one) or the previous section's rc'.

Fix it by really skipping a loop with `continue'. For consistency and readability, also do the same for the default case.

Affected Software

VendorProductVersion RangeStatus
LinuxLinux9a24ce5e29b15c4c6b0c89c04f9df6ce14addefa < 90f3a142b5f8596a565b8e080d18a8050be6edefaffected
LinuxLinux9a24ce5e29b15c4c6b0c89c04f9df6ce14addefa < 422f6547259654bae690713614c794dd1e2c0a0baffected
LinuxLinux9a24ce5e29b15c4c6b0c89c04f9df6ce14addefa < c4249cf6e80b1bd62a6a409aaabe760fe025dac3affected
LinuxLinux9a24ce5e29b15c4c6b0c89c04f9df6ce14addefa < 83e3e515fd261600ed8491fb0a8bcdfb115c904eaffected
LinuxLinux6.4affected
LinuxLinux0 < 6.4unaffected
LinuxLinux6.12.111 <= 6.12.*unaffected
LinuxLinux6.18.53 <= 6.18.*unaffected
LinuxLinux7.2.7 <= 7.2.*unaffected
LinuxLinux7.3-rc3 <= *unaffected

Weaknesses

References