Cloudanix VulnDB

CVE-2026-98292

None

CVSS

—

EPSS

0.2%

Published

Oct 6, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in Linux Bluetooth software could let nearby devices read parts of system memory or make the computer crash.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Data Exposure
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Out-of-bounds memory read in btmtksdio and btmtkuart Bluetooth drivers when casting short WMT events to structs without length validation, allowing reads past the end of the SKB buffer.

Why it matters to the business

Potential kernel memory disclosure or system instability on Linux devices using MediaTek MT792x Bluetooth chips, increasing risk of data leaks or crashes in wireless subsystems.

How an attack unfolds

An attacker supplies a truncated or malformed WMT event from firmware or a paired device; the driver skips length checks, casts the skb directly, and reads op/flag/status fields beyond allocated memory.

How to fix it

Update the Linux kernel to a version containing the skb_pull_data length validation for WMT events and the header-only FUNC_CTRL decode logic; rebuild and deploy the btmtk driver modules.

How to confirm the fix worked

Confirm the patch by inspecting btmtksdio.c and btmtkuart.c for skb_pull_data calls before struct access, then exercise WMT event paths on MT7920/MT7921/MT7922/MT7925 hardware with both normal and short events.

Typical attack path

  1. Establish Bluetooth connection or load malicious firmware interaction
  2. Send short WMT event lacking expected header or FUNC_CTRL status bytes
  3. Trigger skb access without validation in btmtksdio/btmtkuart
  4. Read kernel memory past skb bounds or induce driver fault

How to detect it

Search kernel logs and dmesg for oops, warnings, or panics referencing btmtksdio, btmtkuart, or WMT event parsing; correlate with unexpected Bluetooth resets.

What your security team should do

  • Prioritize kernel upgrades for systems exposing Bluetooth on affected MediaTek chips
  • Add kernel log monitoring for btmtk driver faults
  • Disable unused Bluetooth interfaces until patched

The record

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access btmtksdio.c and btmtkuart.c cast a received WMT event straight to struct btmtk_hci_wmt_evt and read its op/flag fields without checking the event is long enough to contain them, unlike btmtk.c. The FUNC_CTRL case then further casts to struct btmtk_hci_wmt_evt_funcc and reads its 2-byte status field, again without a length check. Firmware that sends a short or malformed WMT event makes both drivers read past the end of the received SKB. Mirror btmtk.c: validate the base WMT header with skb_pull_data() before touching any of its fields, and when a FUNC_CTRL event turns out to be the short, header-only form (a plain enable/disable ack with no status word), decode the result from the header's own flag byte instead (0 = success, otherwise failure). Verified setup on MT7920, MT7921, MT7922 and MT7925: no regression.

Affected packages

Ecosystem Package Introduced Fixed