---
id: CVE-2026-98819
title: 'Bluetooth: btintel: validate DDC record lengths'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  Bluetooth: btintel: validate DDC record lengths

  Parse DDC record lengths in unsigned storage so 0xFF does not wrap.
  Reject records smaller than the mandatory three-byt…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 145f2368c5fd7962e37315ccc092670743019d08 <
    069031f569f1681f17e863f48c221a6091b47850
  - >-
    Linux >= 145f2368c5fd7962e37315ccc092670743019d08 <
    b0fce76873a5e6a6820354409b26693ac5f8b251
  - >-
    Linux >= 145f2368c5fd7962e37315ccc092670743019d08 <
    f3617369fbb30a4d2e54841ab8e92ca4fa211e56
  - >-
    Linux >= 145f2368c5fd7962e37315ccc092670743019d08 <
    c9c15d4d8956df8c564f7c210e4dc5b9b820d97a
  - Linux 4.4
published: '2026-10-18'
updated: '2026-10-18'
sourceUpdated: '2026-10-18T15:49:11.226Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-98819'
references:
  - url: 'https://git.kernel.org/stable/c/069031f569f1681f17e863f48c221a6091b47850'
  - url: 'https://git.kernel.org/stable/c/b0fce76873a5e6a6820354409b26693ac5f8b251'
  - url: 'https://git.kernel.org/stable/c/f3617369fbb30a4d2e54841ab8e92ca4fa211e56'
  - url: 'https://git.kernel.org/stable/c/c9c15d4d8956df8c564f7c210e4dc5b9b820d97a'
tags:
  - cve.org
ingestedAt: '2026-10-18T16:47:32.474Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btintel: validate DDC record lengths

Parse DDC record lengths in unsigned storage so 0xFF does not wrap.
Reject records smaller than the mandatory three-byte header, records
exceeding U8_MAX, and records exceeding remaining firmware bytes before
issuing Intel_Write_DDC.

This issue was reported by Claude Mythos.

## Affected

- `Linux >= 145f2368c5fd7962e37315ccc092670743019d08 < 069031f569f1681f17e863f48c221a6091b47850`
- `Linux >= 145f2368c5fd7962e37315ccc092670743019d08 < b0fce76873a5e6a6820354409b26693ac5f8b251`
- `Linux >= 145f2368c5fd7962e37315ccc092670743019d08 < f3617369fbb30a4d2e54841ab8e92ca4fa211e56`
- `Linux >= 145f2368c5fd7962e37315ccc092670743019d08 < c9c15d4d8956df8c564f7c210e4dc5b9b820d97a`
- `Linux 4.4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.