CVE-2026-98111: Bluetooth: btintel: validate version TLV value lengths
High 7.1 EPSS 0.1% Linux kernel
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: validate version TLV value lengths btintel_parse_version_tlv() verifies that a complete TLV is present in the response, but it does not ensure that the value is long enough for the specific TLV type. A short value can therefore cause an out-of-bounds read through get_unaligned_le16(), get_unaligned_le32(), or memcpy(). Reject values shorter than the minimum required by each known TLV type. Also reject responses that do not contain the Command Complete Status field.
- CVE-2026-98111CVE identifier
- 7.1CVSS 3.1 base score (high)
- 0.1%EPSS: chance of exploitation in the next 30 days (higher than 2% of CVEs)
- 2026-09-25published
What do these terms mean? CVE · CVSS score · exploited (KEV) · EPSS · backported fix · all terms
What to do now
- Check whether you run Linux kernel and which version (commands below).
- Install the fixed version for your system: see “Patch it” below.
- Reboot into the new kernel (uname -r to confirm); live patching (kpatch, Ubuntu Livepatch, SUSE kGraft/klp) can defer the reboot for some CVEs
Affected and fixed versions
Affected:
- Linux Linux 57375beef71af9f245e88357fa71d9600650cb7d to before e9cf7f175c00d36b060828f4eac8d2e246ee079b
- Linux Linux 57375beef71af9f245e88357fa71d9600650cb7d to before 83499ac3ca62e43ed40f7574b13ed398a6891511
- Linux Linux 57375beef71af9f245e88357fa71d9600650cb7d to before 76948d207d0978a613ce06a05cba07284a5578a7
- Linux Linux 57375beef71af9f245e88357fa71d9600650cb7d to before 5ec43df2830b73e004147303bf7914ca884d6770
- Linux Linux 57375beef71af9f245e88357fa71d9600650cb7d to before a086c0892969bf8a0151b0f12bd14a68827c88b2
- Linux Linux 5.10
Patch it
Use the commands for your system. Distribution packages often keep an older version number with the fix backported, so compare with the fixed package versions in the table below, not only with the upstream version.
Debian
sudo apt update
sudo apt install --only-upgrade linux-image-amd64Ubuntu
sudo apt update
sudo apt install --only-upgrade linux-image-generic (or the installed flavour: linux-image-aws, -azure, -gcp, -virtual)RHEL, AlmaLinux, Rocky, Oracle
sudo dnf upgrade --refresh kernelFedora
sudo dnf upgrade --refresh kernelSUSE / openSUSE
sudo zypper refresh
sudo zypper update kernel-defaultAmazon Linux
sudo dnf upgrade --releasever=latest kernel kernel6.12Arch Linux
sudo pacman -SyuAlpine
apk update && apk upgrade linux-lts linux-virtFreeBSD
not LinuxGeneral update steps for every system are on the Linux and Unix & BSD pages; after updating, see which services to restart.
Fix status in Linux distributions
| Release | Package | Status | Fixed version / advisory |
|---|---|---|---|
| Debian 12 | linux | not fixed yet | |
| Debian 13 | linux | fixed | 6.12.111-1 |
| Debian testing | linux | fixed | 7.2.7-1 |
| Debian 12 | linux-6.12 | fixed | 6.12.111-1~deb12u1 |
| Red Hat Enterprise Linux 9 | kernel | fix deferred | |
| Red Hat Enterprise Linux 9 | kernel-rt | fix deferred | |
| Red Hat Enterprise Linux 8 | kernel | fix deferred | |
| Red Hat Enterprise Linux 8 | kernel-rt | fix deferred | |
| Red Hat Enterprise Linux 10 | kernel | fix deferred | |
From the Debian security tracker, Ubuntu CVE tracker and Red Hat Security Data API, refreshed every few hours.
Sources
- https://git.kernel.org/stable/c/e9cf7f175c00d36b060828f4eac8d2e246ee079b
- https://git.kernel.org/stable/c/83499ac3ca62e43ed40f7574b13ed398a6891511
- https://git.kernel.org/stable/c/76948d207d0978a613ce06a05cba07284a5578a7
- https://git.kernel.org/stable/c/5ec43df2830b73e004147303bf7914ca884d6770
- https://git.kernel.org/stable/c/a086c0892969bf8a0151b0f12bd14a68827c88b2
- CVE-2026-98111 on CVE.org
- CVE-2026-98111 on NVD
Page generated automatically from official sources on 2026-11-03 18:05 UTC. Always confirm with your vendor's advisory.