---
id: "CVE-2026-98819"
kind: "vulnerability"
aliases: ["CVE-2026-98819"]
title: "Linux kernel: Bluetooth Intel firmware DDC record length check missing"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["bluetooth", "infrastructure", "intel-hardware", "linux-kernel"]
not_affected_if: ["driver-not-loaded", "no-intel-bluetooth"]
published_at: "2026-10-18T16:17:36+00:00"
first_seen_at: "2026-10-23T21:57:17+00:00"
updated_at: "2026-10-25T05:14:45+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98819", "first_seen_at": "2026-10-23T21:57:17+00:00"}]
---

# Linux kernel: Bluetooth Intel firmware DDC record length check missing

The Linux kernel's Intel Bluetooth driver (btintel) parsed DDC record lengths in a way that could wrap around on the value 0xFF, and did not check records against the header size, the maximum size, or the remaining firmware bytes. The sources do not say what an attacker gets from this, so the impact is not confirmed.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the running kernel version with `uname -r` and compare it against the fixed kernel release in the upstream commit.
- Check whether the Intel Bluetooth driver is loaded with `lsmod | grep btintel`.

## Fix

- Update the Linux kernel to a release that includes the btintel DDC length validation fix (version unknown from the sources).

## Timeline

- 2026-10-23T21:57:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-98819

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btintel: validate DDC record lengths

Parse DDC record lengths in unsigned storage so 0xFF does not wrap.
Reject records smaller than the mandatory three-byte header, records
exceeding U8_MAX, and records exceeding remaining firmware bytes before
issuing Intel_Write_DDC.

This issue was reported by Claude Mythos.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_