CVE-2026-98111

Summary

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btintel: validate version TLV value lengths

btintel_parse_version_tlv() verifies that a complete TLV is present in the response, but it does not ensure that the value is long enough for the specific TLV type. A short value can therefore cause an out-of-bounds read through get_unaligned_le16(), get_unaligned_le32(), or memcpy().

Reject values shorter than the minimum required by each known TLV type. Also reject responses that do not contain the Command Complete Status field.

Affected Software

VendorProductVersion RangeStatus
LinuxLinux57375beef71af9f245e88357fa71d9600650cb7d < 83499ac3ca62e43ed40f7574b13ed398a6891511affected
LinuxLinux57375beef71af9f245e88357fa71d9600650cb7d < 76948d207d0978a613ce06a05cba07284a5578a7affected
LinuxLinux57375beef71af9f245e88357fa71d9600650cb7d < 5ec43df2830b73e004147303bf7914ca884d6770affected
LinuxLinux57375beef71af9f245e88357fa71d9600650cb7d < a086c0892969bf8a0151b0f12bd14a68827c88b2affected
LinuxLinux5.10affected
LinuxLinux0 < 5.10unaffected
LinuxLinux6.12.111 <= 6.12.*unaffected
LinuxLinux6.18.53 <= 6.18.*unaffected
LinuxLinux7.2.7 <= 7.2.*unaffected
LinuxLinux7.3-rc2 <= *unaffected

Weaknesses

References