CVE-2026-98819
Received Received - Intake

Bluetooth: btintel DDC Record Length Validation Flaw

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: validate DDC record lengths Parse DDC record lengths in unsigned storage so 0xFF does not wrap. Reject records smaller than the mandatory three-byte header, records exceeding U8_MAX, and records exceeding remaining firmware bytes before issuing Intel_Write_DDC. This issue was reported by Claude Mythos.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98819
EUVD
EUVD-2026-103904

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
Linux Linux 145f2368c5fd7962e37315ccc092670743019d08
Linux Linux 145f2368c5fd7962e37315ccc092670743019d08
Linux Linux 145f2368c5fd7962e37315ccc092670743019d08
Linux Linux 145f2368c5fd7962e37315ccc092670743019d08
Linux Linux 4.4

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves improper validation of Bluetooth DDC record lengths. The issue occurs when parsing DDC records, where a value of 0xFF could cause an integer wrap-around due to unsigned storage. The fix ensures records are validated to reject those smaller than the mandatory three-byte header, exceeding U8_MAX, or exceeding remaining firmware bytes before executing Intel_Write_DDC.

Impact Analysis

This vulnerability could allow an attacker to manipulate Bluetooth firmware operations by sending malformed DDC records. This might lead to unexpected behavior, crashes, or potential unauthorized access to Bluetooth functionality on affected Linux systems.

Mitigation Strategies

Update the Linux kernel to the latest patched version to address the Bluetooth DDC record length validation issue. Monitor vendor advisories for firmware updates if applicable.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98819. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart