Live › vulnerability › CVE-2026-98732
Go to dashboardThe Linux kernel's Intel Bluetooth driver (btintel) printed a hardware exception string without a length bound, so it could read past the end of its 12-byte buffer. The fix limits the print to the packet length.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running a Linux kernel with an Intel Bluetooth controller driven by the btintel module. The sources do not say which kernel versions are affected or whether the over-read can be triggered remotely. Systems without Intel Bluetooth hardware are unlikely to be affected.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: btintel: fix buffer over-read in btintel_hw_error()
The "Exception info %s" print uses skb->data + 1, but the 12-byte payload is not guaranteed to be NUL-terminated and can be read past its end.
Bound the print with "%.*s" and skb->len - 1.
This page as .md · .json · in your agent: get_signal("CVE-2026-98732")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.