CVE-2026-98110 PUBLISHED

Bluetooth: btintel: bound firmware ID by TLV length

Assigner: Linux
Reserved: 25.09.2026 Published: 25.09.2026 Updated: 25.09.2026

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btintel: bound firmware ID by TLV length

The firmware ID is treated as a NUL-terminated string even though the TLV length is its only boundary. If the value does not contain a NUL terminator, snprintf() can read beyond the received response.

Limit the conversion to the advertised TLV value length.

Product Status

Vendor Linux
Product Linux
Versions Default: unaffected
  • affected from 164c62f958f8c7f0bde1e9a5a8677971c6f28205 to aef56a2bd5aa22808ce508605d7497d2b5e8eb5f (excl.)
  • affected from 164c62f958f8c7f0bde1e9a5a8677971c6f28205 to 058f56de5f48ba4b3be01526006ac83ce9e79f39 (excl.)
  • affected from 164c62f958f8c7f0bde1e9a5a8677971c6f28205 to a07b3024a927892dd46e7dfbed438e8834e24098 (excl.)
  • affected from 164c62f958f8c7f0bde1e9a5a8677971c6f28205 to ac8aa9e0ec93a12a60230066f199f49c3b9aac3d (excl.)
Vendor Linux
Product Linux
Versions Default: affected
  • Version 6.11 is affected
  • unaffected from 0 to 6.11 (excl.)
  • unaffected from 6.12.111 to 6.12.* (incl.)
  • unaffected from 6.18.53 to 6.18.* (incl.)
  • unaffected from 7.2.7 to 7.2.* (incl.)
  • unaffected from 7.3-rc2 to * (incl.)

References