CVE-2026-98110

Published: Sep 25, 2026Modified: Oct 28, 2026

7.1

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Exploitability: 1.8 / Impact: 5.2

Source: NVD

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: bound firmware ID by TLV length The firmware ID is treated as a NUL-terminated string even though the TLV length is its only boundary. If the value does not contain a NUL terminator, snprintf() can read beyond the received response. Limit the conversion to the advertised TLV value length.

Affected (4)

Products: Linux: Linux Kernel

Linux

1 product

Linux Kernel

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Linux Linux Kernel	6.11 ≤ version < 6.12.111
Linux Linux Kernel	6.13 ≤ version < 6.18.53
Linux Linux Kernel	6.19 ≤ version < 7.2.7
Linux Linux Kernel	Version 7.3 rc1