{"id":"CVE-2026-98110","published":"2026-09-25T11:17:42.113","lastModified":"2026-09-25T11:17:42.113","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btintel: bound firmware ID by TLV length\n\nThe firmware ID is treated as a NUL-terminated string even though the\nTLV length is its only boundary. If the value does not contain a NUL\nterminator, snprintf() can read beyond the received response.\n\nLimit the conversion to the advertised TLV value length.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":[],"vendors":[],"products":[],"references":[{"url":"https://git.kernel.org/stable/c/058f56de5f48ba4b3be01526006ac83ce9e79f39","tags":[]},{"url":"https://git.kernel.org/stable/c/a07b3024a927892dd46e7dfbed438e8834e24098","tags":[]},{"url":"https://git.kernel.org/stable/c/ac8aa9e0ec93a12a60230066f199f49c3b9aac3d","tags":[]},{"url":"https://git.kernel.org/stable/c/aef56a2bd5aa22808ce508605d7497d2b5e8eb5f","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}