CVE-2026-98111

Undergoing Analysis Undergoing Analysis - In Progress

Bluetooth: btintel Kernel Memory Read Vulnerability

Publication date: 2026-09-25

Last updated on: 2026-10-28

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: validate version TLV value lengths btintel_parse_version_tlv() verifies that a complete TLV is present in the response, but it does not ensure that the value is long enough for the specific TLV type. A short value can therefore cause an out-of-bounds read through get_unaligned_le16(), get_unaligned_le32(), or memcpy(). Reject values shorter than the minimum required by each known TLV type. Also reject responses that do not contain the Command Complete Status field.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-10-28

Generated

2026-11-08

AI Q&A

2026-09-25

EPSS Evaluated

2026-11-07

NVD

CVE-2026-98111

EUVD

EUVD-2026-86942

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 6.19 (inc) to 7.2.7 (exc)
linux	linux_kernel	7.3
linux	linux_kernel	From 6.13 (inc) to 6.18.53 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.111 (exc)
linux	linux_kernel	From 5.10 (inc) to 6.6.158 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This is a vulnerability in the Linux kernel related to Bluetooth functionality. The issue occurs in the btintel_parse_version_tlv() function, which checks for complete TLV (Type-Length-Value) structures in Bluetooth responses but fails to validate that the value length matches the expected minimum for each TLV type. This can lead to out-of-bounds memory reads when processing malformed Bluetooth responses.

Detection Guidance

This vulnerability is specific to the Linux kernel's Bluetooth subsystem and requires kernel-level inspection. Detection involves checking for out-of-bounds reads in btintel_parse_version_tlv(). No direct network or system commands can detect this without kernel debugging tools. Use kernel logs or tools like ftrace to monitor Bluetooth driver behavior for anomalies.

Impact Analysis

This vulnerability could allow an attacker within Bluetooth range to trigger memory corruption in the Linux kernel by sending specially crafted Bluetooth responses. This might lead to system crashes, privilege escalation, or unauthorized code execution on affected systems.

Compliance Impact

This vulnerability is a low-level Bluetooth driver issue in the Linux kernel that could lead to out-of-bounds memory reads. It does not directly impact compliance with standards like GDPR or HIPAA, as those focus on data protection and privacy controls rather than kernel-level memory safety issues.

Mitigation Strategies

Update your Linux kernel to the latest patched version to address the Bluetooth vulnerability. Monitor vendor advisories for kernel updates and apply them promptly. Disable unnecessary Bluetooth services if not in use to reduce attack surface.

Hi! I’m here to help you understand CVE-2026-98111. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...