In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btrtl: Don't leak return code when parsing firmware format v2 When key_id from chip is zero, rtlbt_parse_firmware_v2() intentionally ignores all security headers. However, the implementation simply breaks from a switch statement and leaks uninitialized return code `rc' (if the first section is a security one) or the previous section's `rc'. Fix it by really skipping a loop with `continue'. For consistency and readability, also do the same for the default case.
Fix
Nothing published yet: no patch, vendor advisory or mitigation reference on NVD, no vendor advisory in the News for this CVE, not in CISA's KEV, no fixed package version. BaselineWatch does not guess at one.
Change history 2
- StatusReceived → PublishedNVD modified 2026-10-19 09:10
- First seenunscoredNVD modified 2026-10-19 10:17
Affected (CPE criteria) 0
NVD has not attached CPE configurations yet.
References 5
- https://git.kernel.org/stable/c/422f6547259654bae690713614c794dd1e2c0a0b
- https://git.kernel.org/stable/c/83e3e515fd261600ed8491fb0a8bcdfb115c904e
- https://git.kernel.org/stable/c/90f3a142b5f8596a565b8e080d18a8050be6edef
- https://git.kernel.org/stable/c/ba96047bba4a6101267cf4f6b3057cbc58e6c554
- https://git.kernel.org/stable/c/c4249cf6e80b1bd62a6a409aaabe760fe025dac3