Bluetooth: btintel: validate version TLV value lengths
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: validate version TLV value lengths btintel_parse_version_tlv() verifies that a complete TLV is present in the response, but it does not ensure that the value is long enough for the specific TLV type. A short value can therefore cause an out-of-bounds read through get_unaligned_le16(), get_unaligned_le32(), or memcpy(). Reject values shorter than the minimum required by each known TLV type. Also reject responses that do not contain the Command Complete Status field.
CVE-2026-98111
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-98111
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "57375beef71af9f245e88357fa71d9600650cb7d",
"lessThan": "e9cf7f175c00d36b060828f4eac8d2e246ee079b",
"versionType": "git"
},
{
"status": "affected",
"version": "57375beef71af9f245e88357fa71d9600650cb7d",
"lessThan": "83499ac3ca62e43ed40f7574b13ed398a6891511",
"versionType": "git"
},
{
"status": "affected",
"version": "57375beef71af9f245e88357fa71d9600650cb7d",
"lessThan": "76948d207d0978a613ce06a05cba07284a5578a7",
"versionType": "git"
},
{
"status": "affected",
"version": "57375beef71af9f245e88357fa71d9600650cb7d",
"lessThan": "5ec43df2830b73e004147303bf7914ca884d6770",
"versionType": "git"
},
{
"status": "affected",
"version": "57375beef71af9f245e88357fa71d9600650cb7d",
"lessThan": "a086c0892969bf8a0151b0f12bd14a68827c88b2",
"versionType": "git"
}
],
"programFiles": [
"drivers/bluetooth/btintel.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "5.10"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "5.10",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.111",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/bluetooth/btintel.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-98111
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #38211 · Revision 1
- Added to Heist Feed
- Publisher date