CVE-2026-97907

This flaw occurs in the Linux kernel's Bluetooth RTL driver. When firmware with a key identifier of zero is parsed, the driver purposefully skips security headers but unintentionally leaks uninitialized or previous iteration return codes through the kernel log or other output. This leakage provides an attacker with internal information about the outcome of firmware parsing, potentially exposing details about the kernel's state or the validity of firmware checks, but does not enable code execution or modification of system state.

All Linux kernel builds that incorporate the btrtl driver and support firmware format v2 are potentially affected. The vulnerability exists in any kernel version prior to the patch that added proper loop handling; specific revision numbers are not publicly listed, so any unpatched kernel with the vulnerable driver code should be considered at risk.

The CVSS score of 5.5 places the flaw in the medium severity range. With an EPSS score of less than 1% and no listing in CISA’s KEV catalog, the likelihood of exploitation is low. Based on the description, the likely attack vector is an attacker supplying a crafted firmware image over a Bluetooth connection to the target device; if the Bluetooth interface is exposed to untrusted parties, the attacker could trigger the leak and gather sensitive internal information, though no direct privilege escalation or remote code execution is available from the current description.