CVE-2026-98110 Bluetooth: btintel: bound firmware ID by TLV length
A missing length check in the Linux kernel Bluetooth driver allows reading beyond buffer boundaries, potentially disclosing sensitive memory contents.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98110?
CVE-2026-98110 is a high-severity vulnerability in Linux kernel, published on 25 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: btintel: bound firmware ID by TLV length
The firmware ID is treated as a NUL-terminated string even though the TLV length is its only boundary. If the value does not contain a NUL terminator, snprintf() can read beyond the received response.
Limit the conversion to the advertised TLV value length.
Weakness: CWE-125
Which versions are affected by CVE-2026-98110?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-98110?
Apply the vendor's patch.
Is CVE-2026-98110 being exploited?
There is no known exploitation of CVE-2026-98110 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-98110, DEBIAN-CVE-2026-98110, GHSA-7mj5-jcph-6x3p, UBUNTU-CVE-2026-98110.