CVE-2026-98819

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98819", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.371Z", "datePublished": "2026-10-18T15:49:11.226Z", "dateUpdated": "2026-10-30T12:39:59.162Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:39:59.162Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btintel: validate DDC record lengths\n\nParse DDC record lengths in unsigned storage so 0xFF does not wrap.\nReject records smaller than the mandatory three-byte header, records\nexceeding U8_MAX, and records exceeding remaining firmware bytes before\nissuing Intel_Write_DDC.\n\nThis issue was reported by Claude Mythos."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/bluetooth/btintel.c"], "versions": [{"version": "145f2368c5fd7962e37315ccc092670743019d08", "lessThan": "780665bed305718a9fbb10e4aa4d5570d772c9f6", "status": "affected", "versionType": "git"}, {"version": "145f2368c5fd7962e37315ccc092670743019d08", "lessThan": "93f00db7441eec84a11029662f04b152386107a9", "status": "affected", "versionType": "git"}, {"version": "145f2368c5fd7962e37315ccc092670743019d08", "lessThan": "e65c8f4ca39959889fcaf9779c3adf1a421aeb8d", "status": "affected", "versionType": "git"}, {"version": "145f2368c5fd7962e37315ccc092670743019d08", "lessThan": "7df748aa9f9ecab514e5989ed89c9ba35b6e5574", "status": "affected", "versionType": "git"}, {"version": "145f2368c5fd7962e37315ccc092670743019d08", "lessThan": "069031f569f1681f17e863f48c221a6091b47850", "status": "affected", "versionType": "git"}, {"version": "145f2368c5fd7962e37315ccc092670743019d08", "lessThan": "b0fce76873a5e6a6820354409b26693ac5f8b251", "status": "affected", "versionType": "git"}, {"version": "145f2368c5fd7962e37315ccc092670743019d08", "lessThan": "f3617369fbb30a4d2e54841ab8e92ca4fa211e56", "status": "affected", "versionType": "git"}, {"version": "145f2368c5fd7962e37315ccc092670743019d08", "lessThan": "c9c15d4d8956df8c564f7c210e4dc5b9b820d97a", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/bluetooth/btintel.c"], "versions": [{"version": "4.4", "status": "affected"}, {"version": "0", "lessThan": "4.4", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.273", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.224", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.113", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.56", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.10", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4", "versionEndExcluding": "5.10.273"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4", "versionEndExcluding": "5.15.224"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4", "versionEndExcluding": "6.12.113"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4", "versionEndExcluding": "6.18.56"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4", "versionEndExcluding": "7.2.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/780665bed305718a9fbb10e4aa4d5570d772c9f6"}, {"url": "https://git.kernel.org/stable/c/93f00db7441eec84a11029662f04b152386107a9"}, {"url": "https://git.kernel.org/stable/c/e65c8f4ca39959889fcaf9779c3adf1a421aeb8d"}, {"url": "https://git.kernel.org/stable/c/7df748aa9f9ecab514e5989ed89c9ba35b6e5574"}, {"url": "https://git.kernel.org/stable/c/069031f569f1681f17e863f48c221a6091b47850"}, {"url": "https://git.kernel.org/stable/c/b0fce76873a5e6a6820354409b26693ac5f8b251"}, {"url": "https://git.kernel.org/stable/c/f3617369fbb30a4d2e54841ab8e92ca4fa211e56"}, {"url": "https://git.kernel.org/stable/c/c9c15d4d8956df8c564f7c210e4dc5b9b820d97a"}], "title": "Bluetooth: btintel: validate DDC record lengths", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/bluetooth/btintel.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "780665bed305718a9fbb10e4aa4d5570d772c9f6", "status": "affected", "version": "145f2368c5fd7962e37315ccc092670743019d08", "versionType": "git"}, {"lessThan": "93f00db7441eec84a11029662f04b152386107a9", "status": "affected", "version": "145f2368c5fd7962e37315ccc092670743019d08", "versionType": "git"}, {"lessThan": "e65c8f4ca39959889fcaf9779c3adf1a421aeb8d", "status": "affected", "version": "145f2368c5fd7962e37315ccc092670743019d08", "versionType": "git"}, {"lessThan": "7df748aa9f9ecab514e5989ed89c9ba35b6e5574", "status": "affected", "version": "145f2368c5fd7962e37315ccc092670743019d08", "versionType": "git"}, {"lessThan": "069031f569f1681f17e863f48c221a6091b47850", "status": "affected", "version": "145f2368c5fd7962e37315ccc092670743019d08", "versionType": "git"}, {"lessThan": "b0fce76873a5e6a6820354409b26693ac5f8b251", "status": "affected", "version": "145f2368c5fd7962e37315ccc092670743019d08", "versionType": "git"}, {"lessThan": "f3617369fbb30a4d2e54841ab8e92ca4fa211e56", "status": "affected", "version": "145f2368c5fd7962e37315ccc092670743019d08", "versionType": "git"}, {"lessThan": "c9c15d4d8956df8c564f7c210e4dc5b9b820d97a", "status": "affected", "version": "145f2368c5fd7962e37315ccc092670743019d08", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/bluetooth/btintel.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.4"}, {"lessThan": "4.4", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.273", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.224", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.113", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.56", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btintel: validate DDC record lengths\n\nParse DDC record lengths in unsigned storage so 0xFF does not wrap.\nReject records smaller than the mandatory three-byte header, records\nexceeding U8_MAX, and records exceeding remaining firmware bytes before\nissuing Intel_Write_DDC.\n\nThis issue was reported by Claude Mythos."}], "id": "CVE-2026-98819", "lastModified": "2026-10-30T13:21:29.033", "metrics": {}, "published": "2026-10-18T16:17:36.143", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/069031f569f1681f17e863f48c221a6091b47850"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/780665bed305718a9fbb10e4aa4d5570d772c9f6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7df748aa9f9ecab514e5989ed89c9ba35b6e5574"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/93f00db7441eec84a11029662f04b152386107a9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b0fce76873a5e6a6820354409b26693ac5f8b251"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c9c15d4d8956df8c564f7c210e4dc5b9b820d97a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e65c8f4ca39959889fcaf9779c3adf1a421aeb8d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f3617369fbb30a4d2e54841ab8e92ca4fa211e56"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: Bluetooth: btintel: validate DDC record lengths", "id": "2555248", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555248"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.4", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nBluetooth: btintel: validate DDC record lengths\nParse DDC record lengths in unsigned storage so 0xFF does not wrap.\nReject records smaller than the mandatory three-byte header, records\nexceeding U8_MAX, and records exceeding remaining firmware bytes before\nissuing Intel_Write_DDC.\nThis issue was reported by Claude Mythos.", "A flaw was found in the Linux kernel's Intel Bluetooth driver. When processing Device Descriptor Configuration (DDC) records, the driver fails to properly validate record lengths, allowing integer wrapping and reading past buffer boundaries. An attacker capable of supplying crafted firmware data could trigger an out-of-bounds read, leading to a Denial of Service (DoS) via a system crash."], "name": "CVE-2026-98819", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98819\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98819\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98819.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[145f2368c5fd7962e37315ccc092670743019d08,069031f569f1681f17e863f48c221a6091b47850)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[145f2368c5fd7962e37315ccc092670743019d08,b0fce76873a5e6a6820354409b26693ac5f8b251)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[145f2368c5fd7962e37315ccc092670743019d08,f3617369fbb30a4d2e54841ab8e92ca4fa211e56)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[145f2368c5fd7962e37315ccc092670743019d08,c9c15d4d8956df8c564f7c210e4dc5b9b820d97a)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.4"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,4.4)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.113,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.56,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.10,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-18T20:30:17.102612+00:00", "updated": "2026-10-24T02:15:17.500997+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}