CVE-2026-98110

A flaw was found in the Linux kernel's Intel Bluetooth driver. An attacker with a malicious or compromised Bluetooth device could exploit this vulnerability by providing a crafted response during firmware initialization that lacks a null terminator. Because the driver treats the firmware identifier as a null-terminated string rather than enforcing the advertised length boundary, it reads beyond the allocated memory buffer. This flaw can result in a Denial of Service (DoS) via a system crash or potentially expose sensitive kernel memory.

A low-impact out-of-bounds read flaw was found in the Linux kernel's Intel Bluetooth (btintel) driver as shipped in Red Hat Enterprise Linux 9 and 10, Red Hat In-Vehicle OS 2, and the RHEL CoreOS 9-based OpenShift Container Platform 4 and 5 streams. When parsing a firmware-version TLV response, the driver treats the firmware identifier as a NUL-terminated string without limiting the read to the advertised TLV length. A malicious or compromised Intel Bluetooth controller supplying a crafted response that lacks a NUL terminator can cause the kernel to read past the received buffer, which can crash the system (denial of service) and potentially expose adjacent kernel memory. Exploitation requires an attacker to attach or control the local Bluetooth controller hardware or its firmware; the flaw is not directly reachable from a remote Bluetooth peer. For this reason Red Hat assesses the impact as low, which differs from the Moderate severity suggested by the CVSS:3.1 base score of 5.5. Earlier RHEL 6, 7, and 8 kernels and earlier RHEL 9 and RHEL CoreOS streams are not affected because the vulnerable firmware-ID parsing code is not present there. Because the flaw is rated low impact, fixes for the affected streams are deferred to a future update; the residual risk is limited to denial of service or limited information exposure by an attacker who already controls the Bluetooth controller hardware.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.