CVE-2026-98292
Received Received - Intake

Bluetooth: btmtksdio and btmtkuart WMT Event Length Validation Flaw

Publication date: 2026-10-06

Last updated on: 2026-10-06

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access btmtksdio.c and btmtkuart.c cast a received WMT event straight to struct btmtk_hci_wmt_evt and read its op/flag fields without checking the event is long enough to contain them, unlike btmtk.c. The FUNC_CTRL case then further casts to struct btmtk_hci_wmt_evt_funcc and reads its 2-byte status field, again without a length check. Firmware that sends a short or malformed WMT event makes both drivers read past the end of the received SKB. Mirror btmtk.c: validate the base WMT header with skb_pull_data() before touching any of its fields, and when a FUNC_CTRL event turns out to be the short, header-only form (a plain enable/disable ack with no status word), decode the result from the header's own flag byte instead (0 = success, otherwise failure). Verified setup on MT7920, MT7921, MT7922 and MT7925: no regression.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-06
Last Modified
2026-10-06
Generated
2026-10-06
AI Q&A
2026-10-06
EPSS Evaluated
N/A
NVD
CVE-2026-98292
EUVD
EUVD-2026-93220

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
Linux Linux e0b67035a90b58d01f911fed77b6e3da153da66e
Linux Linux e0b67035a90b58d01f911fed77b6e3da153da66e
Linux Linux 5.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in the Linux kernel's Bluetooth drivers for MediaTek chipsets (btmtksdio and btmtkuart). It allows firmware to send malformed Bluetooth WMT events that could cause the drivers to read past the end of received data buffers. The issue occurs because the drivers cast received events to specific structures without first verifying the event length contains the required fields.

Impact Analysis

This could lead to kernel memory corruption or crashes if malicious firmware sends specially crafted Bluetooth events. On affected systems, it might cause system instability, unexpected reboots, or potential privilege escalation if combined with other exploits. Normal Bluetooth operations could be disrupted.

Mitigation Strategies

Update your Linux kernel to the latest patched version to resolve this Bluetooth driver vulnerability. Check your distribution's security updates or kernel release notes for the fix.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98292. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart