All vulnerabilities
CVE-2026-98292

Linux: Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.16%Chance of exploitation activity in the next 30 days, higher than 5% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in5a5cfd8488c97e1b8939515429fe4c81e9f2df4fAlso 8879e3e0a84a86954c855caceead4867e74a9a27CVE List
Published6 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 5a5cfd8488c97e1b8939515429fe4c81e9f2df4fLinuxCVE List
  • 8879e3e0a84a86954c855caceead4867e74a9a27LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access

btmtksdio.c and btmtkuart.c cast a received WMT event straight to struct btmtk_hci_wmt_evt and read its op/flag fields without checking the event is long enough to contain them, unlike btmtk.c. The FUNC_CTRL case then further casts to struct btmtk_hci_wmt_evt_funcc and reads its 2-byte status field, again without a length check. Firmware that sends a short or malformed WMT event makes both drivers read past the end of the received SKB.

Mirror btmtk.c: validate the base WMT header with skb_pull_data() before touching any of its fields, and when a FUNC_CTRL event turns out to be the short, header-only form (a plain enable/disable ack with no status word), decode the result from the header's own flag byte instead (0 = success, otherwise failure).

Verified setup on MT7920, MT7921, MT7922 and MT7925: no regression.

Text from CVE List

Affected versions 6

  • Linuxaffected: e0b67035a90b58d01f911fed77b6e3da153da66e before 5a5cfd8488c97e1b8939515429fe4c81e9f2df4fCVE List
  • Linuxaffected: e0b67035a90b58d01f911fed77b6e3da153da66e before 8879e3e0a84a86954c855caceead4867e74a9a27CVE List
  • Linuxaffected: 5.1CVE List
  • Linuxunaffected: all versions before 5.1CVE List
  • Linuxunaffected: 7.2.8 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 2