SB20261022338 - Out-of-bounds read in Linux kernel bluetooth driver
Published: October 22, 2026
Security Bulletin ID
SB20261022338
CSH Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Information disclosure
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 vulnerability.
1) Out-of-bounds read (CVE-ID: CVE-2026-98732)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to potentially disclose kernel memory through diagnostic output.
The vulnerability exists due to an out-of-bounds read in btintel_hw_error() in drivers/bluetooth/btintel.c when logging a Bluetooth exception payload that is not NUL-terminated. A local user can trigger logging of such a payload to potentially expose memory beyond its boundary through the unbounded "Exception info %s" format operation.
Remediation
Install update from vendor's website.
References
- https://git.kernel.org/stable/c/40eb4b18ad167b63644c27fa67a7400ba050379a
- https://git.kernel.org/stable/c/673f707518e8ef03306f84c512cb160971f175fe
- https://git.kernel.org/stable/c/bbc7de352f3f3864369c904aac944c7de84c6e7b
- https://git.kernel.org/stable/c/be58b239d2be5da7a7fac11d3eb8bf75dce6511b
- https://git.kernel.org/stable/c/c42ce5373405ca93946311652c51ccfeb1c2d913