All vulnerabilities
CVE-2026-98111

Linux: Bluetooth: btintel: validate version TLV value lengths

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 5% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in83499ac3ca62e43ed40f7574b13ed398a6891511Also 76948d207d0978a613ce06a05cba07284a5578a7, 5ec43df2830b73e004147303bf7914ca884d6770CVE List
Published25 Sep 2026Updated 19 Oct 2026CVE List

What fixes it

  • 83499ac3ca62e43ed40f7574b13ed398a6891511LinuxCVE List
  • 76948d207d0978a613ce06a05cba07284a5578a7LinuxCVE List
  • 5ec43df2830b73e004147303bf7914ca884d6770LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btintel: validate version TLV value lengths

btintel_parse_version_tlv() verifies that a complete TLV is present in the response, but it does not ensure that the value is long enough for the specific TLV type. A short value can therefore cause an out-of-bounds read through get_unaligned_le16(), get_unaligned_le32(), or memcpy().

Reject values shorter than the minimum required by each known TLV type. Also reject responses that do not contain the Command Complete Status field.

Text from CVE List

Affected versions 12

  • Linuxaffected: 57375beef71af9f245e88357fa71d9600650cb7d before e9cf7f175c00d36b060828f4eac8d2e246ee079bCVE List
  • Linuxaffected: 57375beef71af9f245e88357fa71d9600650cb7d before 83499ac3ca62e43ed40f7574b13ed398a6891511CVE List
  • Linuxaffected: 57375beef71af9f245e88357fa71d9600650cb7d before 76948d207d0978a613ce06a05cba07284a5578a7CVE List
  • Linuxaffected: 57375beef71af9f245e88357fa71d9600650cb7d before 5ec43df2830b73e004147303bf7914ca884d6770CVE List
  • Linuxaffected: 57375beef71af9f245e88357fa71d9600650cb7d before a086c0892969bf8a0151b0f12bd14a68827c88b2CVE List
  • Linuxaffected: 5.10CVE List
  • Linuxunaffected: all versions before 5.10CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2.7 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5