CVE-2026-98292 Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access
A missing length check in Linux kernel Bluetooth drivers allows out-of-bounds reads, potentially causing crashes or code execution via malformed firmware events.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98292?
CVE-2026-98292 is a memory corruption vulnerability in Linux, published on 6 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access
btmtksdio.c and btmtkuart.c cast a received WMT event straight to struct btmtk_hci_wmt_evt and read its op/flag fields without checking the event is long enough to contain them, unlike btmtk.c. The FUNC_CTRL case then further casts to struct btmtk_hci_wmt_evt_funcc and reads its 2-byte status field, again without a length check. Firmware that sends a short or malformed WMT event makes both drivers read past the end of the received SKB.
Mirror btmtk.c: validate the base WMT header with skb_pull_data() before touching any of its fields, and when a FUNC_CTRL event turns out to be the short, header-only form (a plain enable/disable ack with no status word), decode the result from the header's own flag byte instead (0 = success, otherwise failure).
Verified setup on MT7920, MT7921, MT7922 and MT7925: no regression.
Which versions are affected by CVE-2026-98292?
How do I fix CVE-2026-98292?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-98292 being exploited?
There is no known exploitation of CVE-2026-98292 in the wild and no public exploit code.
Sources
Also known as AZL-106050, BELL-CVE-2026-98292, DEBIAN-CVE-2026-98292, GHSA-p633-q8r4-85r4, UBUNTU-CVE-2026-98292.