CVE-2026-97907

Received Received - Intake

Bluetooth Firmware Parsing Flaw in Linux Kernel

Publication date: 2026-09-25

Last updated on: 2026-10-03

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btrtl: Don't leak return code when parsing firmware format v2 When key_id from chip is zero, rtlbt_parse_firmware_v2() intentionally ignores all security headers. However, the implementation simply breaks from a switch statement and leaks uninitialized return code `rc' (if the first section is a security one) or the previous section's `rc'. Fix it by really skipping a loop with `continue'. For consistency and readability, also do the same for the default case.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-10-03

Generated

2026-10-15

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-97907

EUVD

EUVD-2026-86761

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves incorrect handling of Bluetooth firmware parsing. When a chip's key_id is zero, the function rtlbt_parse_firmware_v2() skips security headers but fails to properly reset the return code 'rc'. This can lead to uninitialized or incorrect return values, potentially causing undefined behavior or security issues during firmware processing.

Detection Guidance

This vulnerability is specific to the Linux kernel's Bluetooth Realtek driver (btrtl) and relates to firmware parsing. Detection requires checking the kernel version and examining the btrtl driver for the affected code path. No direct network detection commands are applicable.

Impact Analysis

The impact is limited to systems using affected Linux kernel versions with Bluetooth functionality. If exploited, it could allow unauthorized access or manipulation of Bluetooth firmware, potentially leading to system instability or security breaches. However, the vulnerability requires specific conditions (key_id zero) to trigger.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it is a low-level Bluetooth firmware parsing issue in the Linux kernel. It does not involve data exposure, unauthorized access, or privacy violations that these regulations typically address.

Mitigation Strategies

Update your Linux kernel to the latest patched version to resolve this Bluetooth firmware parsing issue. Check your distribution's security advisories for kernel updates addressing CVE-2026-97907.

Hi! I’m here to help you understand CVE-2026-97907. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70