EUVD-2026-86941
GHSA-7mj5-jcph-6x3p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local access on host with Intel Bluetooth
-
ExploitTrigger btintel firmware ID TLV parsing
-
Executionsnprintf reads beyond TLV boundary
-
ImpactLeak adjacent kernel memory or crash kernel
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the target to use the btintel driver with Intel Bluetooth hardware and to process a firmware-ID TLV whose value lacks a NUL terminator during firmware/response parsing; snprintf() then reads beyond the advertised TLV value length (the only boundary). Limiting factors: the vulnerable code path only runs on systems with Intel Bluetooth adapters, the CVSS indicates local access with low privileges (PR:L) and no user interaction, and the malformed response must reach the driver's TLV parser during initialization. The sources do not state whether the triggering TLV is attacker-supplied from local userspace or from the controller firmware, so the realistic reach depends on that unstated trust boundary. |
| Impact | This is a moderate-severity local information-disclosure/denial-of-service flaw (CWE-125 out-of-bounds read) in the Linux kernel's btintel Intel Bluetooth driver. The supplied CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H, 7.1) indicates local access with low privileges, no user interaction, and high confidentiality and availability impact but no integrity impact - consistent with an over-read that can leak adjacent kernel memory and/or crash the kernel. The exploitation signals argue against treating this as a widespread emergency: EPSS is very low (0.17%, 5th percentile), the CVE is NOT on CISA KEV, and no public exploit or PoC reference is present (only vendor fix commits). The vuln.today priority is 'this_week', which aligns with a real-but-not-critical kernel fix rather than an act-now situation. One point to verify: the CVSS claims AV:L/PR:L, but the actual trigger is a malformed TLV firmware-ID response consumed during Intel Bluetooth firmware initialization - depending on threat model the untrusted input originates from the Bluetooth controller/firmware rather than a local user process, so the real-world attack surface is narrower than a generic local-privilege bug and is confined to systems with Intel Bluetooth hardware using btintel. |
| Exploit ScenarioDerived | A low-privileged local actor or a malicious/compromised Intel Bluetooth controller supplies a firmware-ID TLV whose value is not NUL-terminated during device initialization; the btintel driver's snprintf() then reads past the advertised TLV length, disclosing adjacent kernel memory or faulting the kernel. No public exploit code or PoC is identified, and the attack is limited to systems using the btintel driver with Intel Bluetooth hardware. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
Out-of-bounds read (CWE-125) in the Linux kernel's btintel Intel Bluetooth driver occurs when a firmware-ID TLV value is not NUL-terminated: the code treats the value as a string and lets snprintf() read past the advertised TLV value length, which is the only boundary it enforces. Systems running the btintel driver with Intel Bluetooth adapters and processing such a malformed response during firmware/TLV parsing are affected; the assessed vector is local, low-privileged (PR:L), no user interaction, with high confidentiality and high availability impact. EPSS is low at 0.17% (5th percentile), no public exploit has been identified at time of analysis, and vendor fixes are listed as 6.18.53, 6.12.111, 7.2.7 and 7.3-rc2, with a vuln.today priority decision of this_week.
RemediationAI
Apply the vendor kernel updates that contain the fix: 6.18.53, 6.12.111, 7.2.7 or 7.3-rc2, or backport the upstream commit corresponding to your branch (aef56a2bd5aa22808ce508605d7497d2b5e8eb5f, 058f56de5f48ba4b3be01526006ac83ce9e79f39, a07b3024a927892dd46e7dfbed438e8834e24098 and ac8aa9e0ec93a12a60230066f199f49c3b9aac3d; see https://git.kernel.org/stable/c/aef56a2bd5aa22808ce508605d7497d2b5e8eb5f and https://nvd.nist.gov/vuln/detail/CVE-2026-98110). Because this is kernel code, the change takes effect only after the updated kernel is booted, so schedule a reboot; distributions that ship the btintel driver must pick up the patched kernel rather than a user-space package. No workaround or configuration-level mitigation is documented in the available sources, and the vendor fix is the complete remediation for the TLV parsing path.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The btintel driver in the Linux kernel handles Intel Bluetooth controller firmware, including parsing TLV (type-length-value) formatted responses such as the firmware ID value. The length field of a TLV is the authoritative boundary for its value, but this code path instead treated the value as a NUL-terminated C string, so when no terminator is present snprintf() continues reading beyond the advertised value length - a classic CWE-125 out-of-bounds read caused by a mismatch between the length-delimited data format and a string API that relies on in-band termination. The snprintf() destination size limits how much is copied but does not stop the source scan for a NUL byte. CPE data identifies the affected product generically as cpe:2.3:a:linux:linux, and the EUVD record frames the flaw as a commit-range issue beginning at 164c62f958f8c7f0bde1e9a5a8677971c6f28205 with fixes in aef56a2bd5aa22808ce508605d7497d2b5e8eb5f, 058f56de5f48ba4b3be01526006ac83ce9e79f39, a07b3024a927892dd46e7dfbed438e8834e24098 and ac8aa9e0ec93a12a60230066f199f49c3b9aac3d. The vulnerable parser only executes on hardware with Intel Bluetooth adapters. The available sources do not state whether the triggering TLV is supplied from local userspace or arrives from the controller firmware, so the concrete trust boundary and realistic reach are not established.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Local btintel code path (AV:L) reached with low privilege (PR:L); an out-of-bounds read discloses kernel memory (C:H) and can crash the kernel (A:H) without integrity impact (I:N).
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: btintel: bound firmware ID by TLV length
The firmware ID is treated as a NUL-terminated string even though the TLV length is its only boundary. If the value does not contain a NUL terminator, snprintf() can read beyond the received response.
Limit the conversion to the advertised TLV value length.
Executive ViewAI
A memory safety flaw in the Linux kernel's Intel Bluetooth driver (btintel) exposes systems with Intel Bluetooth adapters to potential out-of-bounds reads and high-severity availability and confidentiality impact, exploitable by a local low-privileged user. Leadership should care because this affects standard enterprise Linux fleets and could enable local data exposure or system instability, though no public exploit is known and exploitation difficulty is elevated.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB