{"id":33361,"date":"2026-10-06T20:31:51","date_gmt":"2026-10-06T12:31:51","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-98292"},"modified":"2026-10-06T20:31:51","modified_gmt":"2026-10-06T12:31:51","slug":"cve-2026-98292","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-98292","title":{"rendered":"CVE-2026-98292 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btmtksdio,"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access<\/p>\n<p>btmtksdio.c and btmtkuart.c cast a received WMT event straight to<br \/>\nstruct btmtk_hci_wmt_evt and read its op\/flag fields without checking<br \/>\nthe event is long enough to contain them, unlike btmtk.c. The<br \/>\nFUNC_CTRL case then further casts to struct btmtk_hci_wmt_evt_funcc<br \/>\nand reads its 2-byte status field, again without a length check.<br \/>\nFirmware that sends a short or malformed WMT event makes both drivers<br \/>\nread past the end of the received SKB.<\/p>\n<p>Mirror btmtk.c: validate the base WMT header with skb_pull_data()<br \/>\nbefore touching any of its fields, and when a FUNC_CTRL event turns<br \/>\nout to be the short, header-only form (a plain enable\/disable ack<br \/>\nwith no status word), decode the result from the header&#8217;s own flag<br \/>\nbyte instead (0 = success, otherwise failure).<\/p>\n<p>Verified setup on MT7920, MT7921, MT7922 and MT7925: no regression.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access<\/p>\n<p>btmtksdio.c and btmtkuart.c cast a received WMT ev<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-33361","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/33361","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=33361"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=33361"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=33361"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}