Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2026-98732

Bluetooth: btintel: fix buffer over-read in btintel_hw_error()

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: fix buffer over-read in btintel_hw_error() The "Exception info %s" print uses skb->data + 1, but the 12-byte payload is not guaranteed to be NUL-terminated and can be read past its end. Bound the print with "%.*s" and skb->len - 1.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 973bb97e5aee56edddaae3d5c96877101ad509c0 to < 162bb126d5c07a0150a171f8f3f1996e445922b3affected
  • 973bb97e5aee56edddaae3d5c96877101ad509c0 to < d850e34c73175f5d7860b17f4810fcb6e5ab8727affected
  • 973bb97e5aee56edddaae3d5c96877101ad509c0 to < 0fa8630506f36374911772647bc5bcfeb47c5195affected
  • 973bb97e5aee56edddaae3d5c96877101ad509c0 to < be58b239d2be5da7a7fac11d3eb8bf75dce6511baffected
  • 973bb97e5aee56edddaae3d5c96877101ad509c0 to < bbc7de352f3f3864369c904aac944c7de84c6e7baffected
  • 973bb97e5aee56edddaae3d5c96877101ad509c0 to < c42ce5373405ca93946311652c51ccfeb1c2d913affected
  • 973bb97e5aee56edddaae3d5c96877101ad509c0 to < 673f707518e8ef03306f84c512cb160971f175feaffected
  • 973bb97e5aee56edddaae3d5c96877101ad509c0 to < 40eb4b18ad167b63644c27fa67a7400ba050379aaffected

Linux Linux

Default version status: affected

  • 4.3affected
  • 0 to < 4.3unaffected
  • 5.10.273 to ≤ 5.10.*unaffected
  • 5.15.224 to ≤ 5.15.*unaffected
  • 6.1.191 to ≤ 6.1.*unaffected
  • 6.6.160 to ≤ 6.6.*unaffected
  • 6.12.113 to ≤ 6.12.*unaffected
  • 6.18.56 to ≤ 6.18.*unaffected
  • 7.2.10 to ≤ 7.2.*unaffected
  • 7.3 to ≤ *unaffected

References