CVE-2026-97907: Bluetooth: btrtl: Don't leak return code when parsing firmware format v2
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: btrtl: Don't leak return code when parsing firmware format v2
When keyid from chip is zero, rtlbtparsefirmwarev2() intentionally ignores all security headers. However, the implementation simply breaks from a switch statement and leaks uninitialized return code rc' (if the first section is a security one) or the previous section's rc'.
Fix it by really skipping a loop with continue'. For consistency and readability, also do the same for the default case.
Affected Software
Event History
Frequently Asked Questions
Under what condition can the parser use an uninitialized or stale return code?
This occurs when the Bluetooth chip reports a key_id of zero and the firmware uses format v2. If the first parsed section is a security header, rc may be uninitialized; otherwise, it may retain the return code from a previous section.
Are security headers processed for affected chips?
No. For chips with key_id set to zero, the parser is intended to ignore all security headers. The flaw is in how the parser skips those headers, causing return-code state to leak instead of continuing to the next section.
What change resolves the issue?
The fix skips the affected parser-loop iterations with continue rather than only breaking out of the switch statement. The same loop-skipping behavior is also applied to the default case for consistency.