Bluetooth Vulnerability in Linux Kernel Affects Various Products

CVE-2026-98111

What is CVE-2026-98111?

A vulnerability identified within the Bluetooth component of the Linux Kernel allows for potential out-of-bounds reads due to inadequate validation of TLV (Type-Length-Value) lengths. The function responsible for parsing version TLV does not verify if the value length meets minimum requirements for defined TLV types, which could lead to unauthorized memory access and potentially harmful exploitation. To mitigate this risk, it is crucial to implement checks that enforce minimum value lengths and ensure responses include the necessary Command Complete Status field.

References