Cloudanix VulnDB

CVE-2026-98732

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A Linux Bluetooth driver can accidentally read past the end of a small data buffer when reporting hardware errors, which could leak information or crash the system.

Exploitation
Adjacent Network
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Data Exposure
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Buffer over-read in btintel_hw_error() when formatting exception info using skb->data + 1 without bounds or NUL-termination guarantees on the 12-byte payload.

Why it matters to the business

Potential kernel memory disclosure or denial of service on Linux systems handling Bluetooth hardware errors, increasing exposure for devices in affected kernels.

How an attack unfolds

An attacker triggers btintel_hw_error() with a crafted non-NUL-terminated Bluetooth HCI event payload that exceeds the expected 12 bytes, causing the kernel to read past the allocated skb buffer during the %s format.

How to fix it

Apply the upstream kernel patch that changes the print format to "%.*s" bounded by skb->len - 1; rebuild and deploy updated kernel images across all affected Linux distributions.

How to confirm the fix worked

Verify the btintel.c source contains the bounded "%.*s" format and skb->len - 1 length argument; confirm kernel build includes the fix and test with crafted short payloads that previously triggered the over-read.

Typical attack path

  1. Send malicious Bluetooth HCI event to the btintel driver
  2. Cause btintel_hw_error() to execute with skb->len insufficient for safe string access
  3. Kernel performs unbounded read via skb->data + 1 in the print statement
  4. Resulting over-read leads to information leak or oops

How to detect it

Review kernel logs for oops or warnings originating from btintel_hw_error; inspect Bluetooth HCI event traces for malformed payloads lacking termination; correlate with skb allocation sizes in driver paths.

What your security team should do

  • Prioritize kernel updates on all systems exposing Bluetooth via btintel
  • Monitor for new stable releases containing the buffer bound fix
  • Restrict untrusted Bluetooth device pairing until patched

The record

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: fix buffer over-read in btintel_hw_error() The "Exception info %s" print uses skb->data + 1, but the 12-byte payload is not guaranteed to be NUL-terminated and can be read past its end. Bound the print with "%.*s" and skb->len - 1.

Affected packages

Ecosystem Package Introduced Fixed