CVE-2026-98111

A flaw was found in the Linux kernel's Intel Bluetooth driver. When processing version response packets from hardware, the driver fails to verify that Type-Length-Value (TLV) data fields meet the minimum required length. A malicious or rogue Bluetooth controller can supply a crafted response with shortened values to trigger an out-of-bounds read, potentially leading to a system crash and Denial of Service (DoS) or unauthorized information disclosure.

A moderate-severity flaw was found in the Linux kernel's Intel Bluetooth (btintel) driver, which is used in Red Hat Enterprise Linux and other Red Hat products that ship the kernel. The btintel_parse_version_tlv() function verifies that a complete Type-Length-Value (TLV) structure is present in a controller version response, but it does not check that each TLV value is long enough for its specific type. A malicious or rogue Intel Bluetooth controller can therefore supply a crafted version response with shortened TLV values, causing an out-of-bounds read through get_unaligned_le16(), get_unaligned_le32(), or memcpy(). This can crash the kernel, resulting in denial of service. Although the CVE description notes potential information disclosure, Red Hat's assessment found no demonstrated path to disclosing sensitive information (C:N in the CVSS 3.1 vector, score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Red Hat Enterprise Linux 8, 9, and 10 (including the real-time kernel variants), Red Hat In-Vehicle OS, and the OpenShift Container Platform RHEL CoreOS kernels are affected because the vulnerable code is present in those releases. Red Hat Enterprise Linux 6 and 7 are not affected because the vulnerable code is not present. For the affected products, the fix is currently deferred: because the flaw is of moderate impact and exploitation requires a local attacker to control or have physical access to the Intel Bluetooth controller supplying the crafted responses, the fix will be delivered in a future scheduled update rather than an immediate z-stream erratum. The residual risk while the fix is deferred is limited to local denial of service; no write primitive or privilege escalation path is indicated by the upstream fix.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.