CVE-2026-98819 PUBLISHED

Bluetooth: btintel: validate DDC record lengths

Assigner: Linux
Reserved: 25.09.2026 Published: 18.10.2026 Updated: 18.10.2026

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btintel: validate DDC record lengths

Parse DDC record lengths in unsigned storage so 0xFF does not wrap. Reject records smaller than the mandatory three-byte header, records exceeding U8_MAX, and records exceeding remaining firmware bytes before issuing Intel_Write_DDC.

This issue was reported by Claude Mythos.

Product Status

Vendor Linux
Product Linux
Versions Default: unaffected
  • affected from 145f2368c5fd7962e37315ccc092670743019d08 to 069031f569f1681f17e863f48c221a6091b47850 (excl.)
  • affected from 145f2368c5fd7962e37315ccc092670743019d08 to b0fce76873a5e6a6820354409b26693ac5f8b251 (excl.)
  • affected from 145f2368c5fd7962e37315ccc092670743019d08 to f3617369fbb30a4d2e54841ab8e92ca4fa211e56 (excl.)
  • affected from 145f2368c5fd7962e37315ccc092670743019d08 to c9c15d4d8956df8c564f7c210e4dc5b9b820d97a (excl.)
Vendor Linux
Product Linux
Versions Default: affected
  • Version 4.4 is affected
  • unaffected from 0 to 4.4 (excl.)
  • unaffected from 6.12.113 to 6.12.* (incl.)
  • unaffected from 6.18.56 to 6.18.* (incl.)
  • unaffected from 7.2.10 to 7.2.* (incl.)
  • unaffected from 7.3-rc6 to * (incl.)

References