CVE-2026-74532

Received Received - Intake

Bluetooth: btintel Diagnostics Length Validation Flaw

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: Validate length before parsing diagnostics TLV btintel_diagnostics() accesses tlv->val[0] without first validating that the diagnostics VSE is long enough to contain that field, so may cause reading data beyond the received frame. Fix by validating the length before access.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-74532

EUVD

EUVD-2026-59725

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a Bluetooth vulnerability in the Linux kernel where the function btintel_diagnostics() accesses memory without first checking if the input data is long enough. This could lead to reading beyond the intended data buffer.

Detection Guidance

This vulnerability involves improper validation in the Linux kernel's Bluetooth subsystem. Detection requires checking kernel logs for Bluetooth-related errors or crashes, particularly involving btintel. Monitor logs with commands like dmesg | grep -i bluetooth or journalctl -k | grep -i bluetooth. If crashes occur during Bluetooth operations, it may indicate exploitation.

Impact Analysis

An attacker within Bluetooth range could exploit this to cause a denial of service or potentially execute arbitrary code on affected systems by sending malformed Bluetooth packets.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it is a low-level Bluetooth driver issue in the Linux kernel. It may indirectly impact compliance if exploited to access unauthorized data, but no evidence suggests it directly violates these standards.

Mitigation Strategies

Apply the latest Linux kernel update that includes the fix for this vulnerability. If immediate patching is not possible, disable Bluetooth functionality temporarily or restrict Bluetooth device access until the update is applied. Monitor vendor advisories for kernel updates.

Hi! I’m here to help you understand CVE-2026-74532. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70