AZL-104396
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-104396.json
- JSON Data
- https://api.osv.dev/v1/vulns/AZL-104396
- Upstream
- Published
- 2026-09-25T11:17:42Z
- Modified
- 2026-09-26T14:16:20Z
- Summary
- CVE-2026-98111 affecting package kernel 6.6.157.1-1
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: btintel: validate version TLV value lengths
btintel_parse_version_tlv() verifies that a complete TLV is present in the response, but it does not ensure that the value is long enough for the specific TLV type. A short value can therefore cause an out-of-bounds read through get_unaligned_le16(), get_unaligned_le32(), or memcpy().
Reject values shorter than the minimum required by each known TLV type. Also reject responses that do not contain the Command Complete Status field.
- References