CVE-2026-98819: Bluetooth: btintel: validate DDC record lengths
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: btintel: validate DDC record lengths
Parse DDC record lengths in unsigned storage so 0xFF does not wrap. Reject records smaller than the mandatory three-byte header, records exceeding U8MAX, and records exceeding remaining firmware bytes before issuing IntelWriteDDC.
This issue was reported by Claude Mythos.
Affected Software
Event History
Frequently Asked Questions
What conditions are required to trigger the vulnerable code path?
The issue is triggered while parsing Bluetooth DDC records from firmware before sending them through Intel_Write_DDC. A malformed record length, including 0xFF or a length that is too short or extends beyond the remaining firmware data, is required.
Which systems are most likely exposed?
Systems using the Linux kernel Bluetooth btintel driver and processing Intel Bluetooth DDC firmware records are relevant. The provided information does not identify specific kernel versions, Intel adapter models, or default configurations.
What validation does the fix add?
The fix stores and parses DDC record lengths as unsigned values to prevent 0xFF from wrapping. It rejects records shorter than the required three-byte header, records larger than U8_MAX, and records that exceed the remaining firmware bytes.