kernel: Bluetooth: btintel: fix buffer over-read in btintel_hw_error() (CVE-2026-98732)

Overview

A flaw was found in the Linux kernel's Intel Bluetooth driver. When processing hardware error events, the driver logs event data as a string without verifying that the received payload is properly null-terminated. A physically proximate attacker or compromised Bluetooth device could exploit this flaw by sending malformed error events to trigger a buffer over-read. This issue primarily leads to information disclosure of adjacent kernel memory into system logs, and could potentially result in a Denial of Service (DoS) if the system crashes.

Vendor advisories

• Red Hat VEX · Low · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · updated 2026-10-23 · vex

kernel: Bluetooth: btintel: fix buffer over-read in btintel_hw_error() — rated Low by Red Hat. Released 2026-10-18, updated 2026-10-23.

Affected:

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Red Hat Enterprise Linux 9
• Red Hat OpenShift Container Platform 4

No fix planned:

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Red Hat Enterprise Linux 9
• Red Hat OpenShift Container Platform 4

Not affected:

• Red Hat Enterprise Linux 6
• Red Hat Enterprise Linux 7

Remediation

Fix deferred