Live › vulnerability › CVE-2026-98819
Go to dashboardThe Linux kernel's Intel Bluetooth driver (btintel) parsed DDC record lengths in a way that could wrap around on the value 0xFF, and did not check records against the header size, the maximum size, or the remaining firmware bytes. The sources do not say what an attacker gets from this, so the impact is not confirmed.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running a Linux kernel with the Intel Bluetooth driver (btintel) loaded, where Intel Bluetooth firmware is processed. The sources do not say which kernel versions are affected or whether the flaw is reachable from outside the machine. Systems without Intel Bluetooth hardware and without this driver loaded are unlikely to be exposed.
No product ranges from the sources yet.
uname -r and compare it against the fixed kernel release in the upstream commit.lsmod | grep btintel.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: btintel: validate DDC record lengths
Parse DDC record lengths in unsigned storage so 0xFF does not wrap. Reject records smaller than the mandatory three-byte header, records exceeding U8_MAX, and records exceeding remaining firmware bytes before issuing Intel_Write_DDC.
This issue was reported by Claude Mythos.
This page as .md · .json · in your agent: get_signal("CVE-2026-98819")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.