In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: fix buffer over-read in btintel_hw_error() The "Exception… (CVE-2026-98732)

The Linux kernel's Bluetooth 'btintel' driver contained a vulnerability where the function btintel_hw_error() used skb->data + 1 to print exception info without ensuring the 12-byte payload was NUL-terminated. This led to a potential buffer over-read beyond the payload's end. The fix bounded the print operation using a length specifier "%.*s" and limited it to skb->len - 1 bytes, preventing out-of-bounds reads.

The vulnerability could cause the kernel to read memory beyond the intended buffer, potentially leading to information disclosure or kernel instability. However, no specific exploit or active attacks are known. The impact is limited to the Bluetooth subsystem in the Linux kernel.

A fix has been applied to the Linux kernel to properly bound the print operation in btintel_hw_error(). Users should update to a kernel version that includes this fix. Since this is a kernel-level issue, applying the official kernel patch or upgrading to a fixed kernel release is the recommended remediation.