Integer overflow in Linux kernel - CVE-2026-98819

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU157187

Integer overflow in Linux kernel - CVE-2026-98819

Published: October 22, 2026


Vulnerability identifier: #VU157187
CSH Severity: Low
CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-98819
CWE-ID: CWE-190
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local privileged user to trigger out-of-bounds reads and potentially cause a denial of service.

The vulnerability exists due to integer wraparound and insufficient record-length validation in the Linux kernel Bluetooth btintel DDC configuration parser when processing firmware records. A local privileged user can supply malformed DDC configuration data, if able to influence the firmware input, to cause record lengths to wrap or exceed the remaining firmware bytes, potentially triggering out-of-bounds reads and a denial of service.


Affected software

Linux kernel
SUSE Linux Micro
SUSE Linux Micro Extras
kernel-default
kernel-64kb
kernel-64kb-debugsource
kernel-64kb-devel
kernel-default-devel
kernel-syms
kernel-obs-build
kernel-obs-build-debugsource
kernel-default-debugsource
kernel-default-devel-debuginfo

How to mitigate CVE-2026-98819

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
kernel-default - update to 6.4.0-159998.55.1
kernel-64kb - update to 6.4.0-159998.55.1
kernel-64kb-debugsource - update to 6.4.0-159998.55.1
kernel-64kb-devel - update to 6.4.0-159998.55.1
kernel-default-devel - update to 6.4.0-159998.55.1
kernel-syms - update to 6.4.0-159998.55.1
kernel-obs-build - update to 6.4.0-159998.55.1
kernel-obs-build-debugsource - update to 6.4.0-159998.55.1
kernel-default-debugsource - update to 6.4.0-159998.55.1
kernel-default-devel-debuginfo - update to 6.4.0-159998.55.1

External References

Related Security Bulletins