CVE-2026-98110

CVE-2026-98110

published September 25, 2026

CVSS
—
EPSS
0%
Percentile
5.8
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btintel: bound firmware ID by TLV length

The firmware ID is treated as a NUL-terminated string even though the

TLV length is its only boundary. If the value does not contain a NUL

terminator, snprintf() can read beyond the received response.

Limit the conversion to the advertised TLV value length.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00168 · 5.8th percentile
Published
2026-09-25T15:17Z
References (4)
https://git.kernel.org/stable/c/058f56de5f48ba4b3be01526006ac83ce9e79f39 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/a07b3024a927892dd46e7dfbed438e8834e24098 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/ac8aa9e0ec93a12a60230066f199f49c3b9aac3d · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/aef56a2bd5aa22808ce508605d7497d2b5e8eb5f · 416baaa9-dc9f-4396-8d5f-8c081fb06d67
EPSS history
Timeline
  • 27 SEP 03:28Z
    EPSS moved — → 0%
    epss
  • 25 SEP 10:35Z
    Bluetooth: btintel: bound firmware ID by TLV length
    cvelistv5