CVE-2026-98111: Bluetooth: btintel: validate version TLV value lengths
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: btintel: validate version TLV value lengths
btintelparseversiontlv() verifies that a complete TLV is present in the response, but it does not ensure that the value is long enough for the specific TLV type. A short value can therefore cause an out-of-bounds read through getunalignedle16(), getunalignedle32(), or memcpy().
Reject values shorter than the minimum required by each known TLV type. Also reject responses that do not contain the Command Complete Status field.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Update btintel_parse_version_tlv() to reject TLV values shorter than the minimum required for each known TLV type, and reject responses that do not contain the Command Complete Status.
Event History
Frequently Asked Questions
What input is required to trigger the vulnerable parsing path?
The issue is triggered by a Bluetooth response containing a complete TLV whose value is shorter than the minimum length expected for its known TLV type. Responses that omit the Command Complete Status field are also relevant to the corrected validation logic.
What is the impact of a malformed short TLV value?
A short value can cause an out-of-bounds read when the kernel parses it using get_unaligned_le16(), get_unaligned_le32(), or memcpy().
How can I determine whether the fix is present?
The fix rejects TLV values shorter than the minimum required for each known TLV type and rejects responses without a Command Complete Status field. The provided stable kernel references identify commits containing the correction.