CVE-2026-97907

A flaw was found in the Linux kernel's Realtek Bluetooth driver. When processing firmware images on hardware where the chip key identifier is zero, the driver incorrectly manages loop control and evaluates an uninitialized or stale return code. A local user capable of providing firmware or triggering device initialization could exploit this vulnerability to disrupt driver operation, leading to a Denial of Service (DoS).

A low-impact flaw was found in the Linux kernel's Realtek Bluetooth driver (btrtl) as shipped in Red Hat Enterprise Linux 9.4 and later, Red Hat Enterprise Linux 10, Red Hat In-Vehicle OS 2, and OpenShift Container Platform versions 4.16 and later based on RHEL CoreOS 9. When parsing firmware images in format v2 on hardware where the chip key identifier (key_id) is zero, rtlbt_parse_firmware_v2() exits its parsing loop via break instead of skipping the security section headers, causing the function to evaluate an uninitialized or stale return code. This can incorrectly abort firmware parsing and prevent initialization of the Realtek Bluetooth device, resulting in a local denial of service limited to the availability of the Bluetooth adapter. Exploitation requires local access with sufficient privileges to trigger device initialization or control firmware input; there is no impact to confidentiality or integrity. Red Hat Enterprise Linux 6, 7, and 8, RHEL 9.2, the corresponding kernel-rt builds, and OpenShift Container Platform releases based on RHEL CoreOS 8 or earlier RHEL 9 builds are not affected because the firmware format v2 support that introduced this code is not present in those streams. The fix is currently deferred for the affected streams because this is a low-severity, local availability issue in a rarely exercised code path; the residual risk is that firmware parsing may fail and the Realtek Bluetooth adapter may not initialize on affected hardware. Red Hat rates the impact of this flaw as Low rather than the Moderate severity implied by the CVSS 3.1 base score of 5.5, because reliable triggering requires privileged local control of firmware loading or Bluetooth device administration and the resulting denial of service affects only the Bluetooth device rather than the whole system.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.