Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2026-98819

Bluetooth: btintel: validate DDC record lengths

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: validate DDC record lengths Parse DDC record lengths in unsigned storage so 0xFF does not wrap. Reject records smaller than the mandatory three-byte header, records exceeding U8_MAX, and records exceeding remaining firmware bytes before issuing Intel_Write_DDC. This issue was reported by Claude Mythos.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 145f2368c5fd7962e37315ccc092670743019d08 to < 780665bed305718a9fbb10e4aa4d5570d772c9f6affected
  • 145f2368c5fd7962e37315ccc092670743019d08 to < 93f00db7441eec84a11029662f04b152386107a9affected
  • 145f2368c5fd7962e37315ccc092670743019d08 to < e65c8f4ca39959889fcaf9779c3adf1a421aeb8daffected
  • 145f2368c5fd7962e37315ccc092670743019d08 to < 7df748aa9f9ecab514e5989ed89c9ba35b6e5574affected
  • 145f2368c5fd7962e37315ccc092670743019d08 to < 069031f569f1681f17e863f48c221a6091b47850affected
  • 145f2368c5fd7962e37315ccc092670743019d08 to < b0fce76873a5e6a6820354409b26693ac5f8b251affected
  • 145f2368c5fd7962e37315ccc092670743019d08 to < f3617369fbb30a4d2e54841ab8e92ca4fa211e56affected
  • 145f2368c5fd7962e37315ccc092670743019d08 to < c9c15d4d8956df8c564f7c210e4dc5b9b820d97aaffected

Linux Linux

Default version status: affected

  • 4.4affected
  • 0 to < 4.4unaffected
  • 5.10.273 to ≤ 5.10.*unaffected
  • 5.15.224 to ≤ 5.15.*unaffected
  • 6.1.191 to ≤ 6.1.*unaffected
  • 6.6.160 to ≤ 6.6.*unaffected
  • 6.12.113 to ≤ 6.12.*unaffected
  • 6.18.56 to ≤ 6.18.*unaffected
  • 7.2.10 to ≤ 7.2.*unaffected
  • 7.3 to ≤ *unaffected

References