CVE-2026-98111Bluetooth: btintel: validate version TLV value lengths
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: validate version TLV value lengths btintel_parse_version_tlv() verifies that a complete TLV is present in the response, but it does not ensure that the value is long enough for the specific TLV type. A short value can therefore cause an out-of-bounds read through get_unaligned_le16(), get_unaligned_le32(), or memcpy(). Reject values shorter than the minimum required by each known TLV type. Also reject responses that do not contain the Command Complete Status field.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Undergoing Analysis
- Record last updated
- Oct 19, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 57375beef71af9f245e88357fa71d9600650cb7d before e9cf7f175c00d36b060828f4eac8d2e246ee079b; from 57375beef71af9f245e88357fa71d9600650cb7d before 83499ac3ca62e43ed40f7574b13ed398a6891511; from 57375beef71af9f245e88357fa71d9600650cb7d before 76948d207d0978a613ce06a05cba07284a5578a7; 57375beef71af9f245e88357fa71d9600650cb7d builds before 5ec43df2830b73e004147303bf7914ca884d6770; from 57375beef71af9f245e88357fa71d9600650cb7d before a086c0892969bf8a0151b0f12bd14a68827c88b2 | CNA record |
References
- https://git.kernel.org/stable/c/e9cf7f175c00d36b060828f4eac8d2e246ee079b
- https://git.kernel.org/stable/c/83499ac3ca62e43ed40f7574b13ed398a6891511
- https://git.kernel.org/stable/c/76948d207d0978a613ce06a05cba07284a5578a7
- https://git.kernel.org/stable/c/5ec43df2830b73e004147303bf7914ca884d6770
- https://git.kernel.org/stable/c/a086c0892969bf8a0151b0f12bd14a68827c88b2
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.