{"id":"CVE-2026-98819","kind":"vulnerability","aliases":["CVE-2026-98819"],"related":[],"title":"Linux kernel: Bluetooth Intel firmware DDC record length check missing","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btintel: validate DDC record lengths\n\nParse DDC record lengths in unsigned storage so 0xFF does not wrap.\nReject records smaller than the mandatory three-byte header, records\nexceeding U8_MAX, and records exceeding remaining firmware bytes before\nissuing Intel_Write_DDC.\n\nThis issue was reported by Claude Mythos.","summary":"The Linux kernel's Intel Bluetooth driver (btintel) parsed DDC record lengths in a way that could wrap around on the value 0xFF, and did not check records against the header size, the maximum size, or the remaining firmware bytes. The sources do not say what an attacker gets from this, so the impact is not confirmed.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bluetooth","infrastructure","intel-hardware","linux-kernel"],"not_affected_if":["driver-not-loaded","no-intel-bluetooth"],"how_to_check":"- Check the running kernel version with `uname -r` and compare it against the fixed kernel release in the upstream commit.\n- Check whether the Intel Bluetooth driver is loaded with `lsmod | grep btintel`.","fix":"- Update the Linux kernel to a release that includes the btintel DDC length validation fix (version unknown from the sources).","status":"open","published_at":"2026-10-18T16:17:36+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T05:14:45+00:00","updated_at":"2026-10-25T05:14:45+00:00","category":"infrastructure","confidence":0.3,"triage":{"at":"2026-10-25T05:14:45Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the btintel DDC length validation fix (version unknown from the sources).","reach":"unknown","title":"Linux kernel: Bluetooth Intel firmware DDC record length check missing","impact":"medium","summary":"The Linux kernel's Intel Bluetooth driver (btintel) parsed DDC record lengths in a way that could wrap around on the value 0xFF, and did not check records against the header size, the maximum size, or the remaining firmware bytes. The sources do not say what an attacker gets from this, so the impact is not confirmed.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","bluetooth","intel-hardware"],"confidence":0.3,"needs_auth":"unknown","worst_case":"unknown; sources do not describe the attacker outcome","analyst_note":"Find the affected kernel version range and the upstream fix commit, and confirm the attacker outcome and reachability from the kernel.org or NVD record.","how_to_check":"- Check the running kernel version with `uname -r` and compare it against the fixed kernel release in the upstream commit.\n- Check whether the Intel Bluetooth driver is loaded with `lsmod | grep btintel`.","needs_analyst":true,"not_affected_if":["no-intel-bluetooth","driver-not-loaded"],"who_is_affected":"Systems running a Linux kernel with the Intel Bluetooth driver (btintel) loaded, where Intel Bluetooth firmware is processed. The sources do not say which kernel versions are affected or whether the flaw is reachable from outside the machine. Systems without Intel Bluetooth hardware and without this driver loaded are unlikely to be exposed.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000655,"input_tokens":3368,"output_tokens":637,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-98819':13A,16A '0xff':47B,106C 'around':43B 'attack':72B 'bluetooth':3A,17B,30B,92C 'btintel':32B,93C 'byte':64B,118C,129C 'check':9A,51B 'claud':140C 'confirm':81B 'could':41B 'cve':11A,14A 'ddc':6A,34B,95C,99C,134C 'driver':31B 'exceed':121C,126C 'firmwar':5A,63B,128C 'follow':87C 'get':73B 'hardwar':21B 'header':55B,119C 'impact':78B 'infrastructur':18B 'intel':4A,20B,29B,132C 'intel-hardwar':19B 'issu':131C,136C 'kernel':2A,24B,27B,85C 'length':8A,36B,97C,101C 'linux':1A,23B,26B,84C 'linux-kernel':22B 'mandatori':115C 'max':123C 'maximum':58B 'miss':10A 'mytho':141C 'pars':33B,98C 'record':7A,35B,52B,96C,100C,111C,120C,125C 'reject':110C 'remain':62B,127C 'report':138C 'resolv':91C 'say':69B 'size':56B,59B 'smaller':112C 'sourc':66B 'storag':104C 'three':117C 'three-byt':116C 'u8':122C 'unsign':103C 'valid':94C 'valu':46B 'vulner':88C 'way':39B 'wrap':42B,109C 'write':133C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the Intel Bluetooth driver (btintel) loaded, where Intel Bluetooth firmware is processed. The sources do not say which kernel versions are affected or whether the flaw is reachable from outside the machine. Systems without Intel Bluetooth hardware and without this driver loaded are unlikely to be exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:36+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98819","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98819","severity":null,"published_at":"2026-10-18T16:17:36+00:00","modified_at":"2026-10-21T13:21:47+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}