CVE-2026-97907 Bluetooth: btrtl: Don't leak return code when parsing firmware format v2
A flaw in the Linux kernel Bluetooth driver leaks uninitialized memory or previous return codes when parsing firmware, potentially exposing sensitive data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-97907?
CVE-2026-97907 is a vulnerability in Linux, published on 25 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: btrtl: Don't leak return code when parsing firmware format v2
When key_id from chip is zero, rtlbt_parse_firmware_v2() intentionally ignores all security headers. However, the implementation simply breaks from a switch statement and leaks uninitialized return code `rc' (if the first section is a security one) or the previous section's `rc'.
Fix it by really skipping a loop with `continue'. For consistency and readability, also do the same for the default case.
Which versions are affected by CVE-2026-97907?
How do I fix CVE-2026-97907?
Apply the vendor's patch.
Is CVE-2026-97907 being exploited?
There is no known exploitation of CVE-2026-97907 in the wild and no public exploit code.
Sources
Also known as AZL-104846, BELL-CVE-2026-97907, DEBIAN-CVE-2026-97907, GHSA-cc6q-p4xg-qp8m, UBUNTU-CVE-2026-97907.