CVE-2026-98819Medium· 4.4▾ SunlitA flaw was found in the Linux kernel's Intel Bluetooth driver. When processing Device Descriptor Configuration (DDC) records, the driver fails to properly validate record lengths, allowing integer wrapping and reading past buffer boundarie…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 24.2 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 20.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.2%
Last analysed / modified upstream
— → 4.4
none → medium
A flaw was found in the Linux kernel's Intel Bluetooth driver. When processing Device Descriptor Configuration (DDC) records, the driver fails to properly validate record lengths, allowing integer wrapping and reading past buffer boundaries. An attacker capable of supplying crafted firmware data could trigger an out-of-bounds read, leading to a Denial of Service (DoS) via a system crash.
kernel: Bluetooth: btintel: validate DDC record lengths — rated Moderate by Red Hat. Released 2026-10-18, updated 2026-10-23.
Affected:
No fix planned:
Not affected:
Fix deferred
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-72107Medium· 5.5kernel: dm era: fix out-of-bounds memory access for non-zero start sector (CVE-2026-72107)
CVE-2026-64551High· 7.0kernel: sctp: validate STALE_COOKIE cause length before reading staleness (CVE-2026-64551)
CVE-2026-64546Medium· 5.5kernel: drm/edid: fix OOB read in drm_parse_tiled_block() (CVE-2026-64546)
CVE-2026-64540Medium· 5.5kernel: usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup() (CVE-2026-64540)
CVE-2026-64524Medium· 5.5kernel: drm/hyperv: validate resolution_count and fix WIN8 fallback (CVE-2026-64524)
CVE-2026-64448High· 7.0kernel: smb: client: restrict implied bcc[0] exemption to responses without data area (CVE-2026-64448)