CVE-2026-98111

Bluetooth: btintel: validate version TLV value lengths

State: Published
Severity: Not scored
Published: Sep 25, 2026
Updated: Oct 19, 2026
Reserved: Sep 25, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btintel: validate version TLV value lengths

btintel_parse_version_tlv() verifies that a complete TLV is present in the response, but it does not ensure that the value is long enough for the specific TLV type. A short value can therefore cause an out-of-bounds read through get_unaligned_le16(), get_unaligned_le32(), or memcpy().

Reject values shorter than the minimum required by each known TLV type. Also reject responses that do not contain the Command Complete Status field.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	57375beef71af9f245e88357fa71d9600650cb7d to before e9cf7f175c00d36b060828f4eac8d2e246ee079bAffected 57375beef71af9f245e88357fa71d9600650cb7d to before 83499ac3ca62e43ed40f7574b13ed398a6891511Affected 57375beef71af9f245e88357fa71d9600650cb7d to before 76948d207d0978a613ce06a05cba07284a5578a7Affected 57375beef71af9f245e88357fa71d9600650cb7d to before 5ec43df2830b73e004147303bf7914ca884d6770Affected 57375beef71af9f245e88357fa71d9600650cb7d to before a086c0892969bf8a0151b0f12bd14a68827c88b2Affected
LinuxLinux	5.10Affected before 5.10Not affected 6.6.158 through 6.6.Not affected 6.12.111 through 6.12.Not affected 6.18.53 through 6.18.Not affected 7.2.7 through 7.2.Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

57375beef71af9f245e88357fa71d9600650cb7d to before e9cf7f175c00d36b060828f4eac8d2e246ee079bAffected
57375beef71af9f245e88357fa71d9600650cb7d to before 83499ac3ca62e43ed40f7574b13ed398a6891511Affected
57375beef71af9f245e88357fa71d9600650cb7d to before 76948d207d0978a613ce06a05cba07284a5578a7Affected
57375beef71af9f245e88357fa71d9600650cb7d to before 5ec43df2830b73e004147303bf7914ca884d6770Affected
57375beef71af9f245e88357fa71d9600650cb7d to before a086c0892969bf8a0151b0f12bd14a68827c88b2Affected

LinuxLinux

5.10Affected
before 5.10Not affected
6.6.158 through 6.6.*Not affected
6.12.111 through 6.12.*Not affected
6.18.53 through 6.18.*Not affected
7.2.7 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.