{"id":"CVE-2026-98292","revision":"4939860d6c9b4e01b5b2227e7bf2b25c","records":[{"revision":"4939860d6c9b4e01b5b2227e7bf2b25c","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-98292","aliases":[],"title":"Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access\n\nbtmtksdio.c and btmtkuart.c cast a received WMT event straight to\nstruct btmtk_hci_wmt_evt and read its op/flag fields without checking\nthe event is long enough to contain them, unlike btmtk.c. The\nFUNC_CTRL case then further casts to struct btmtk_hci_wmt_evt_funcc\nand reads its 2-byte status field, again without a length check.\nFirmware that sends a short or malformed WMT event makes both drivers\nread past the end of the received SKB.\n\nMirror btmtk.c: validate the base WMT header with skb_pull_data()\nbefore touching any of its fields, and when a FUNC_CTRL event turns\nout to be the short, header-only form (a plain enable/disable ack\nwith no status word), decode the result from the header's own flag\nbyte instead (0 = success, otherwise failure).\n\nVerified setup on MT7920, MT7921, MT7922 and MT7925: no regression.","state":0,"publishedAt":"2026-10-06T08:45:51.807+00:00","modifiedAt":"2026-10-19T09:17:03.377+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/bluetooth/btmtksdio.c\",\n                        \"drivers/bluetooth/btmtkuart.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"e0b67035a90b58d01f911fed77b6e3da153da66e\",\n                            \"lessThan\": \"5a5cfd8488c97e1b8939515429fe4c81e9f2df4f\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"e0b67035a90b58d01f911fed77b6e3da153da66e\",\n                            \"lessThan\": \"8879e3e0a84a86954c855caceead4867e74a9a27\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/bluetooth/btmtksdio.c\",\n                        \"drivers/bluetooth/btmtkuart.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"5.1\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"5.1\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.8\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/5a5cfd8488c97e1b8939515429fe4c81e9f2df4f","https://git.kernel.org/stable/c/8879e3e0a84a86954c855caceead4867e74a9a27"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-98292","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-98292","identifiers":["CVE-2026-98292"]},"retained":false,"historicalAffected":[]}],"coverage":[]}