{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74532", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.912Z", "datePublished": "2026-08-15T12:27:46.597Z", "dateUpdated": "2026-08-17T05:21:15.978Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T05:21:15.978Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btintel: Validate length before parsing diagnostics TLV\n\nbtintel_diagnostics() accesses tlv->val[0] without first validating\nthat the diagnostics VSE is long enough to contain that field, so\nmay cause reading data beyond the received frame.\n\nFix by validating the length before access."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/bluetooth/btintel.c"], "versions": [{"version": "af395330abed142a2685bf3d17a938544816bf3c", "lessThan": "c31be902ccbbb0b2c23159a1481dce80d1f9753d", "status": "affected", "versionType": "git"}, {"version": "af395330abed142a2685bf3d17a938544816bf3c", "lessThan": "dd20e30bdbd707ea8ced581f3d7f9e9854634b17", "status": "affected", "versionType": "git"}, {"version": "af395330abed142a2685bf3d17a938544816bf3c", "lessThan": "c618a9a5b08ea2e17bddf4e948be9f75d408fca4", "status": "affected", "versionType": "git"}, {"version": "af395330abed142a2685bf3d17a938544816bf3c", "lessThan": "6ec9c3dc52302b891513f608f5fb478349b15ab3", "status": "affected", "versionType": "git"}, {"version": "af395330abed142a2685bf3d17a938544816bf3c", "lessThan": "b640ff9af3c809ff5ea2077fbba17df1594ec1e4", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/bluetooth/btintel.c"], "versions": [{"version": "6.4", "status": "affected"}, {"version": "0", "lessThan": "6.4", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.151", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.103", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.44", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.8", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.6.151"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.12.103"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.18.44"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "7.1.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/c31be902ccbbb0b2c23159a1481dce80d1f9753d"}, {"url": "https://git.kernel.org/stable/c/dd20e30bdbd707ea8ced581f3d7f9e9854634b17"}, {"url": "https://git.kernel.org/stable/c/c618a9a5b08ea2e17bddf4e948be9f75d408fca4"}, {"url": "https://git.kernel.org/stable/c/6ec9c3dc52302b891513f608f5fb478349b15ab3"}, {"url": "https://git.kernel.org/stable/c/b640ff9af3c809ff5ea2077fbba17df1594ec1e4"}], "title": "Bluetooth: btintel: Validate length before parsing diagnostics TLV", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/bluetooth/btintel.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "c31be902ccbbb0b2c23159a1481dce80d1f9753d", "status": "affected", "version": "af395330abed142a2685bf3d17a938544816bf3c", "versionType": "git"}, {"lessThan": "dd20e30bdbd707ea8ced581f3d7f9e9854634b17", "status": "affected", "version": "af395330abed142a2685bf3d17a938544816bf3c", "versionType": "git"}, {"lessThan": "c618a9a5b08ea2e17bddf4e948be9f75d408fca4", "status": "affected", "version": "af395330abed142a2685bf3d17a938544816bf3c", "versionType": "git"}, {"lessThan": "6ec9c3dc52302b891513f608f5fb478349b15ab3", "status": "affected", "version": "af395330abed142a2685bf3d17a938544816bf3c", "versionType": "git"}, {"lessThan": "b640ff9af3c809ff5ea2077fbba17df1594ec1e4", "status": "affected", "version": "af395330abed142a2685bf3d17a938544816bf3c", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/bluetooth/btintel.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.4"}, {"lessThan": "6.4", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.151", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.103", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.44", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.8", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btintel: Validate length before parsing diagnostics TLV\n\nbtintel_diagnostics() accesses tlv->val[0] without first validating\nthat the diagnostics VSE is long enough to contain that field, so\nmay cause reading data beyond the received frame.\n\nFix by validating the length before access."}], "id": "CVE-2026-74532", "lastModified": "2026-08-17T06:19:50.120", "metrics": {}, "published": "2026-08-15T13:17:58.500", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6ec9c3dc52302b891513f608f5fb478349b15ab3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b640ff9af3c809ff5ea2077fbba17df1594ec1e4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c31be902ccbbb0b2c23159a1481dce80d1f9753d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c618a9a5b08ea2e17bddf4e948be9f75d408fca4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/dd20e30bdbd707ea8ced581f3d7f9e9854634b17"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: Bluetooth: btintel: Validate length before parsing diagnostics TLV", "id": "2517067", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517067"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nBluetooth: btintel: Validate length before parsing diagnostics TLV\nbtintel_diagnostics() accesses tlv->val[0] without first validating\nthat the diagnostics VSE is long enough to contain that field, so\nmay cause reading data beyond the received frame.\nFix by validating the length before access.", "A flaw was found in the Bluetooth `btintel` driver of the Linux kernel. The `btintel_diagnostics()` function fails to validate the length of a diagnostics Vendor Specific Event (VSE) before accessing its data. This oversight allows an attacker to potentially read data beyond the intended memory boundary, which could lead to information disclosure."], "name": "CVE-2026-74532", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-74532\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74532\nhttps://lore.kernel.org/linux-cve-announce/2026081547-CVE-2026-74532-4966@gregkh/T"], "threat_severity": "Moderate"}