{"id":"CVE-2026-98732","kind":"vulnerability","aliases":["CVE-2026-98732"],"related":[],"title":"Linux kernel: Bluetooth Intel driver over-reads a buffer in error logging","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btintel: fix buffer over-read in btintel_hw_error()\n\nThe \"Exception info %s\" print uses skb->data + 1, but the 12-byte\npayload is not guaranteed to be NUL-terminated and can be read past\nits end.\n\nBound the print with \"%.*s\" and skb->len - 1.","summary":"The Linux kernel's Intel Bluetooth driver (btintel) printed a hardware exception string without a length bound, so it could read past the end of its 12-byte buffer. The fix limits the print to the packet length.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bluetooth","infrastructure","intel-hardware","linux-kernel"],"not_affected_if":["no-intel-bluetooth"],"how_to_check":"- unknown","fix":"- Update the Linux kernel to a release that includes the btintel_hw_error() fix; the sources do not name a version.","status":"open","published_at":"2026-10-18T16:17:26+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:17:13+00:00","updated_at":"2026-10-25T05:17:13+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-25T05:17:13Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the btintel_hw_error() fix; the sources do not name a version.","reach":"local","title":"Linux kernel: Bluetooth Intel driver over-reads a buffer in error logging","impact":"low","summary":"The Linux kernel's Intel Bluetooth driver (btintel) printed a hardware exception string without a length bound, so it could read past the end of its 12-byte buffer. The fix limits the print to the packet length.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","bluetooth","intel-hardware"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unknown: a read past a buffer end; impact not stated in sources","analyst_note":"Check the upstream kernel commit or NVD entry for affected and fixed kernel versions and whether the bug is reachable from a nearby Bluetooth device.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-intel-bluetooth"],"who_is_affected":"Systems running a Linux kernel with an Intel Bluetooth controller driven by the btintel module. The sources do not say which kernel versions are affected or whether the over-read can be triggered remotely. Systems without Intel Bluetooth hardware are unlikely to be affected.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000584,"input_tokens":3345,"output_tokens":499,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-98732':16A,19A '1':95C,124C '12':54B,98C 'bluetooth':3A,20B,33B,76C 'bound':44B,116C 'btintel':35B,77C,84C 'buffer':10A,56B,79C 'byte':55B,99C 'could':47B 'cve':14A,17A 'data':94C 'driver':5A,34B 'end':51B,115C 'error':12A,86C 'except':39B,88C 'fix':58B,78C 'follow':71C 'guarante':103C 'hardwar':24B,38B 'hw':85C 'info':89C 'infrastructur':21B 'intel':4A,23B,32B 'intel-hardwar':22B 'kernel':2A,27B,30B,69C 'len':123C 'length':43B,65B 'limit':59B 'linux':1A,26B,29B,68C 'linux-kernel':25B 'log':13A 'nul':107C 'nul-termin':106C 'over-read':6A,80C 'packet':64B 'past':49B,113C 'payload':100C 'print':36B,61B,91C,118C 'read':8A,48B,82C,112C 'resolv':75C 'skb':93C,122C 'string':40B 'termin':108C 'use':92C 'vulner':72C 'without':41B","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with an Intel Bluetooth controller driven by the btintel module. The sources do not say which kernel versions are affected or whether the over-read can be triggered remotely. Systems without Intel Bluetooth hardware are unlikely to be affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:26+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98732","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98732","severity":null,"published_at":"2026-10-18T16:17:26+00:00","modified_at":"2026-10-21T13:21:40+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}