CVE-2026-97907

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-97907", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:18:58.200Z", "datePublished": "2026-09-25T10:22:32.244Z", "dateUpdated": "2026-10-19T09:10:33.668Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:10:33.668Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btrtl: Don't leak return code when parsing firmware format v2\n\nWhen key_id from chip is zero, rtlbt_parse_firmware_v2() intentionally\nignores all security headers. However, the implementation simply breaks\nfrom a switch statement and leaks uninitialized return code `rc' (if the\nfirst section is a security one) or the previous section's `rc'.\n\nFix it by really skipping a loop with `continue'. For consistency and\nreadability, also do the same for the default case."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/bluetooth/btrtl.c"], "versions": [{"version": "9a24ce5e29b15c4c6b0c89c04f9df6ce14addefa", "lessThan": "ba96047bba4a6101267cf4f6b3057cbc58e6c554", "status": "affected", "versionType": "git"}, {"version": "9a24ce5e29b15c4c6b0c89c04f9df6ce14addefa", "lessThan": "90f3a142b5f8596a565b8e080d18a8050be6edef", "status": "affected", "versionType": "git"}, {"version": "9a24ce5e29b15c4c6b0c89c04f9df6ce14addefa", "lessThan": "422f6547259654bae690713614c794dd1e2c0a0b", "status": "affected", "versionType": "git"}, {"version": "9a24ce5e29b15c4c6b0c89c04f9df6ce14addefa", "lessThan": "c4249cf6e80b1bd62a6a409aaabe760fe025dac3", "status": "affected", "versionType": "git"}, {"version": "9a24ce5e29b15c4c6b0c89c04f9df6ce14addefa", "lessThan": "83e3e515fd261600ed8491fb0a8bcdfb115c904e", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/bluetooth/btrtl.c"], "versions": [{"version": "6.4", "status": "affected"}, {"version": "0", "lessThan": "6.4", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.158", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.111", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.53", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.7", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.6.158"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.12.111"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.18.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "7.2.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/ba96047bba4a6101267cf4f6b3057cbc58e6c554"}, {"url": "https://git.kernel.org/stable/c/90f3a142b5f8596a565b8e080d18a8050be6edef"}, {"url": "https://git.kernel.org/stable/c/422f6547259654bae690713614c794dd1e2c0a0b"}, {"url": "https://git.kernel.org/stable/c/c4249cf6e80b1bd62a6a409aaabe760fe025dac3"}, {"url": "https://git.kernel.org/stable/c/83e3e515fd261600ed8491fb0a8bcdfb115c904e"}], "title": "Bluetooth: btrtl: Don't leak return code when parsing firmware format v2", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/bluetooth/btrtl.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "ba96047bba4a6101267cf4f6b3057cbc58e6c554", "status": "affected", "version": "9a24ce5e29b15c4c6b0c89c04f9df6ce14addefa", "versionType": "git"}, {"lessThan": "90f3a142b5f8596a565b8e080d18a8050be6edef", "status": "affected", "version": "9a24ce5e29b15c4c6b0c89c04f9df6ce14addefa", "versionType": "git"}, {"lessThan": "422f6547259654bae690713614c794dd1e2c0a0b", "status": "affected", "version": "9a24ce5e29b15c4c6b0c89c04f9df6ce14addefa", "versionType": "git"}, {"lessThan": "c4249cf6e80b1bd62a6a409aaabe760fe025dac3", "status": "affected", "version": "9a24ce5e29b15c4c6b0c89c04f9df6ce14addefa", "versionType": "git"}, {"lessThan": "83e3e515fd261600ed8491fb0a8bcdfb115c904e", "status": "affected", "version": "9a24ce5e29b15c4c6b0c89c04f9df6ce14addefa", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/bluetooth/btrtl.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.4"}, {"lessThan": "6.4", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.158", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.111", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.53", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btrtl: Don't leak return code when parsing firmware format v2\n\nWhen key_id from chip is zero, rtlbt_parse_firmware_v2() intentionally\nignores all security headers. However, the implementation simply breaks\nfrom a switch statement and leaks uninitialized return code `rc' (if the\nfirst section is a security one) or the previous section's `rc'.\n\nFix it by really skipping a loop with `continue'. For consistency and\nreadability, also do the same for the default case."}], "id": "CVE-2026-97907", "lastModified": "2026-10-19T10:17:41.147", "metrics": {}, "published": "2026-09-25T11:17:17.627", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/422f6547259654bae690713614c794dd1e2c0a0b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/83e3e515fd261600ed8491fb0a8bcdfb115c904e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/90f3a142b5f8596a565b8e080d18a8050be6edef"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ba96047bba4a6101267cf4f6b3057cbc58e6c554"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c4249cf6e80b1bd62a6a409aaabe760fe025dac3"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: Bluetooth: btrtl: Don't leak return code when parsing firmware format v2", "id": "2541160", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2541160"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-908", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nBluetooth: btrtl: Don't leak return code when parsing firmware format v2\nWhen key_id from chip is zero, rtlbt_parse_firmware_v2() intentionally\nignores all security headers. However, the implementation simply breaks\nfrom a switch statement and leaks uninitialized return code `rc' (if the\nfirst section is a security one) or the previous section's `rc'.\nFix it by really skipping a loop with `continue'. For consistency and\nreadability, also do the same for the default case.", "A flaw was found in the Linux kernel's Realtek Bluetooth driver. When processing firmware images on hardware where the chip key identifier is zero, the driver incorrectly manages loop control and evaluates an uninitialized or stale return code. A local user capable of providing firmware or triggering device initialization could exploit this vulnerability to disrupt driver operation, leading to a Denial of Service (DoS)."], "name": "CVE-2026-97907", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-97907\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-97907\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-97907.mbox"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[9a24ce5e29b15c4c6b0c89c04f9df6ce14addefa,90f3a142b5f8596a565b8e080d18a8050be6edef)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[90f3a142b5f8596a565b8e080d18a8050be6edef,422f6547259654bae690713614c794dd1e2c0a0b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[422f6547259654bae690713614c794dd1e2c0a0b,c4249cf6e80b1bd62a6a409aaabe760fe025dac3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c4249cf6e80b1bd62a6a409aaabe760fe025dac3,83e3e515fd261600ed8491fb0a8bcdfb115c904e)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[6.4,6.4]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.4)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.111,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.53,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.7,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-25T14:30:14.460248+00:00", "updated": "2026-10-01T11:15:05.772606+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-908"]}