CVE-2026-98732

Bluetooth: btintel: fix buffer over-read in btintel_hw_error()

State: Published
Severity: Not scored
Published: Oct 18, 2026
Updated: Oct 30, 2026
Reserved: Sep 25, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btintel: fix buffer over-read in btintel_hw_error()

The "Exception info %s" print uses skb->data + 1, but the 12-byte payload is not guaranteed to be NUL-terminated and can be read past its end.

Bound the print with "%.*s" and skb->len - 1.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	973bb97e5aee56edddaae3d5c96877101ad509c0 to before 162bb126d5c07a0150a171f8f3f1996e445922b3Affected 973bb97e5aee56edddaae3d5c96877101ad509c0 to before d850e34c73175f5d7860b17f4810fcb6e5ab8727Affected 973bb97e5aee56edddaae3d5c96877101ad509c0 to before 0fa8630506f36374911772647bc5bcfeb47c5195Affected 973bb97e5aee56edddaae3d5c96877101ad509c0 to before be58b239d2be5da7a7fac11d3eb8bf75dce6511bAffected 973bb97e5aee56edddaae3d5c96877101ad509c0 to before bbc7de352f3f3864369c904aac944c7de84c6e7bAffected 973bb97e5aee56edddaae3d5c96877101ad509c0 to before c42ce5373405ca93946311652c51ccfeb1c2d913Affected 973bb97e5aee56edddaae3d5c96877101ad509c0 to before 673f707518e8ef03306f84c512cb160971f175feAffected 973bb97e5aee56edddaae3d5c96877101ad509c0 to before 40eb4b18ad167b63644c27fa67a7400ba050379aAffected
LinuxLinux	4.3Affected before 4.3Not affected 5.10.273 through 5.10.Not affected 5.15.224 through 5.15.Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.113 through 6.12.Not affected 6.18.56 through 6.18.Not affected 7.2.10 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

973bb97e5aee56edddaae3d5c96877101ad509c0 to before 162bb126d5c07a0150a171f8f3f1996e445922b3Affected
973bb97e5aee56edddaae3d5c96877101ad509c0 to before d850e34c73175f5d7860b17f4810fcb6e5ab8727Affected
973bb97e5aee56edddaae3d5c96877101ad509c0 to before 0fa8630506f36374911772647bc5bcfeb47c5195Affected
973bb97e5aee56edddaae3d5c96877101ad509c0 to before be58b239d2be5da7a7fac11d3eb8bf75dce6511bAffected
973bb97e5aee56edddaae3d5c96877101ad509c0 to before bbc7de352f3f3864369c904aac944c7de84c6e7bAffected
973bb97e5aee56edddaae3d5c96877101ad509c0 to before c42ce5373405ca93946311652c51ccfeb1c2d913Affected
973bb97e5aee56edddaae3d5c96877101ad509c0 to before 673f707518e8ef03306f84c512cb160971f175feAffected
973bb97e5aee56edddaae3d5c96877101ad509c0 to before 40eb4b18ad167b63644c27fa67a7400ba050379aAffected

LinuxLinux

4.3Affected
before 4.3Not affected
5.10.273 through 5.10.*Not affected
5.15.224 through 5.15.*Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.113 through 6.12.*Not affected
6.18.56 through 6.18.*Not affected
7.2.10 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.