In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btintel: Validate length before parsing diagnostics TLV

btintel_diagnostics() accesses tlv->val[0] without first validating
that the diagnostics VSE is long enough to contain that field, so
may cause reading data beyond the received frame.

Fix by validating the length before access.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
af395330abed142a2685bf3d17a938544816bf3c affected < c31be902ccbbb0b2c23159a1481dce80d1f9753d
af395330abed142a2685bf3d17a938544816bf3c affected < dd20e30bdbd707ea8ced581f3d7f9e9854634b17
af395330abed142a2685bf3d17a938544816bf3c affected < c618a9a5b08ea2e17bddf4e948be9f75d408fca4
af395330abed142a2685bf3d17a938544816bf3c affected < 6ec9c3dc52302b891513f608f5fb478349b15ab3
af395330abed142a2685bf3d17a938544816bf3c affected < b640ff9af3c809ff5ea2077fbba17df1594ec1e4
Linux Linux affected
Version Status Constraints
6.4 affected —
0 unaffected < 6.4
6.6.151 unaffected ≤ 6.6.*
6.12.103 unaffected ≤ 6.12.*
6.18.44 unaffected ≤ 6.18.*
7.1.8 unaffected ≤ 7.1.*
7.2-rc6 unaffected ≤ *

No data.

No data.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/6ec9c3dc52302b891513f608f5fb478349b15ab3 cve-icon cve-icon
https://git.kernel.org/stable/c/b640ff9af3c809ff5ea2077fbba17df1594ec1e4 cve-icon cve-icon
https://git.kernel.org/stable/c/c31be902ccbbb0b2c23159a1481dce80d1f9753d cve-icon cve-icon
https://git.kernel.org/stable/c/c618a9a5b08ea2e17bddf4e948be9f75d408fca4 cve-icon cve-icon
https://git.kernel.org/stable/c/dd20e30bdbd707ea8ced581f3d7f9e9854634b17 cve-icon cve-icon
History

Sat, 15 Aug 2026 12:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: Validate length before parsing diagnostics TLV btintel_diagnostics() accesses tlv->val[0] without first validating that the diagnostics VSE is long enough to contain that field, so may cause reading data beyond the received frame. Fix by validating the length before access.
Title Bluetooth: btintel: Validate length before parsing diagnostics TLV
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-08-15T12:27:46.597Z

Reserved: 2026-08-15T05:44:03.912Z

Link: CVE-2026-74532

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-15T13:17:58.500

Modified: 2026-08-15T13:17:58.500

Link: CVE-2026-74532

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses

No weakness.