In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: validate DDC record lengths Parse DDC record lengths in… (CVE-2026-98819)

The Linux kernel Bluetooth component btintel had a vulnerability in handling DDC record lengths. The flaw was due to parsing DDC record lengths in a way that allowed 0xFF to wrap, potentially causing improper processing of records. The fix involved validating that records are at least three bytes long (the mandatory header size), do not exceed the maximum unsigned 8-bit value (U8_MAX), and do not exceed the remaining firmware bytes before calling Intel_Write_DDC. This validation prevents malformed or malicious DDC records from being processed incorrectly.

Improper validation of DDC record lengths could lead to incorrect processing of Bluetooth firmware data, which might cause unexpected behavior or potential security issues in the Bluetooth subsystem of the Linux kernel. The exact impact is not detailed, and no known exploits in the wild have been reported.

A fix has been applied to the Linux kernel to properly validate DDC record lengths and reject invalid records. Users should update to the fixed Linux kernel version containing this patch. No additional mitigation steps are indicated.