CVE-2026-74532

A flaw was found in the Bluetooth btintel driver of the Linux kernel. The btintel_diagnostics() function fails to validate the length of a diagnostics Vendor Specific Event (VSE) before accessing its data. This oversight allows an attacker to potentially read data beyond the intended memory boundary, which could lead to information disclosure.

This flaw is rated as Moderate severity because exploitation requires local access and the physical presence of Intel Bluetooth hardware, significantly limiting the blast radius. Malformed diagnostic vendor-specific frames processed by the controller driver can trigger an out-of-bounds memory read, potentially causing a system crash or restricted kernel memory leakage. Standard Red Hat Enterprise Linux server installations rarely utilize Bluetooth hardware, which substantially minimizes exposure across typical deployments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.