Answer in brief
CVE-2026-98732 records a Unknown severity vulnerability in Bluetooth: btintel: fix buffer over-read in btintel_hw_error(). The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=973bb97e5aee56edddaae3d5c96877101ad509c0 <bbc7de352f3f3864369c904aac944c7de84c6e7b || >=973bb97e5aee56edddaae3d5c96877101ad509c0 <c42ce5373405ca93946311652c51ccfeb1c2d913 || >=973bb97e5aee56edddaae3d5c96877101ad509c0 <673f707518e8ef03306f84c512cb160971f175fe || >=973bb97e5aee56edddaae3d5c96877101ad509c0 <40eb4b18ad167b63644c27fa67a7400ba050379a | bbc7de352f3f3864369c904aac944c7de84c6e7b, c42ce5373405ca93946311652c51ccfeb1c2d913, 673f707518e8ef03306f84c512cb160971f175fe, 40eb4b18ad167b63644c27fa67a7400ba050379a |
| Linux/Linuxgeneric | 4.3 | Not reported |
| Linux/Linuxgeneric | >=973bb97e5aee56edddaae3d5c96877101ad509c0 <be58b239d2be5da7a7fac11d3eb8bf75dce6511b || >=973bb97e5aee56edddaae3d5c96877101ad509c0 <bbc7de352f3f3864369c904aac944c7de84c6e7b || >=973bb97e5aee56edddaae3d5c96877101ad509c0 <c42ce5373405ca93946311652c51ccfeb1c2d913 || >=973bb97e5aee56edddaae3d5c96877101ad509c0 <673f707518e8ef03306f84c512cb160971f175fe || >=973bb97e5aee56edddaae3d5c96877101ad509c0 <40eb4b18ad167b63644c27fa67a7400ba050379a | be58b239d2be5da7a7fac11d3eb8bf75dce6511b, bbc7de352f3f3864369c904aac944c7de84c6e7b, c42ce5373405ca93946311652c51ccfeb1c2d913, 673f707518e8ef03306f84c512cb160971f175fe, 40eb4b18ad167b63644c27fa67a7400ba050379a |
Published upstream
Oct 18, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 21, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 18, 2026
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: fix buffer over-read in btintel_hw_error() The "Exception info %s" print uses skb->data + 1, but the 12-byte payload is not guaranteed to be NUL-terminated and can be read past its end. Bound the print with "%.*s" and skb->len - 1.
Quoted source text, attributed separately from HOL analysis.