CVE-2026-98732: Bluetooth: btintel: fix buffer over-read in btintel_hw_error()
Published Oct 18, 2026
·Updated
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: btintel: fix buffer over-read in btintelhwerror()
The "Exception info %s" print uses skb->data + 1, but the 12-byte payload is not guaranteed to be NUL-terminated and can be read past its end.
Bound the print with "%.s" and skb->len - 1.
Affected Software
1 affected component
Linux Linux kernel
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In btintel_hw_error(), bound the exception-info print with "%.*s" and skb->len - 1 so the payload cannot be read past its end.
Event History
Oct 18, 2026
CVE Published
via MITRE·03:47 PM
Data Sourced
via MITRE·03:47 PM
Description
Data Sourced
via NVD·04:17 PM
Description