{"id":"CVE-2026-98110","revision":"add484db0613477fbcb6dc4ac6119ddb","records":[{"revision":"add484db0613477fbcb6dc4ac6119ddb","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-98110","aliases":[],"title":"Bluetooth: btintel: bound firmware ID by TLV length","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btintel: bound firmware ID by TLV length\n\nThe firmware ID is treated as a NUL-terminated string even though the\nTLV length is its only boundary. If the value does not contain a NUL\nterminator, snprintf() can read beyond the received response.\n\nLimit the conversion to the advertised TLV value length.","state":0,"publishedAt":"2026-09-25T10:35:58.136+00:00","modifiedAt":"2026-10-19T09:14:02.695+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/bluetooth/btintel.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"164c62f958f8c7f0bde1e9a5a8677971c6f28205\",\n                            \"lessThan\": \"aef56a2bd5aa22808ce508605d7497d2b5e8eb5f\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"164c62f958f8c7f0bde1e9a5a8677971c6f28205\",\n                            \"lessThan\": \"058f56de5f48ba4b3be01526006ac83ce9e79f39\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"164c62f958f8c7f0bde1e9a5a8677971c6f28205\",\n                            \"lessThan\": \"a07b3024a927892dd46e7dfbed438e8834e24098\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"164c62f958f8c7f0bde1e9a5a8677971c6f28205\",\n                            \"lessThan\": \"ac8aa9e0ec93a12a60230066f199f49c3b9aac3d\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/bluetooth/btintel.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.11\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.11\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.111\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.53\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.7\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/aef56a2bd5aa22808ce508605d7497d2b5e8eb5f","https://git.kernel.org/stable/c/058f56de5f48ba4b3be01526006ac83ce9e79f39","https://git.kernel.org/stable/c/a07b3024a927892dd46e7dfbed438e8834e24098","https://git.kernel.org/stable/c/ac8aa9e0ec93a12a60230066f199f49c3b9aac3d"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-98110","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-98110","identifiers":["CVE-2026-98110"]},"retained":false,"historicalAffected":[]}],"coverage":[]}