In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access btmtksdio.c and btmtkuart.c cast a received WMT event straight to struct btmtk_hci_wmt_evt and read its op/flag fields without checking the event is long enough to contain them, unlike btmtk.c. The FUNC_CTRL case then further casts to struct btmtk_hci_wmt_evt_funcc and reads its 2-byte status field, again without a length check. Firmware that sends a short or malformed WMT event makes both drivers read past the end of the received SKB. Mirror btmtk.c: validate the base WMT header with skb_pull_data() before touching any of its fields, and when a FUNC_CTRL event turns out to be the short, header-only form (a plain enable/disable ack with no status word), decode the result from the header's own flag byte instead (0 = success, otherwise failure). Verified setup on MT7920, MT7921, MT7922 and MT7925: no regression.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access btmtksdio.c and     btmtkuart.c cast a received WMT event straight to struct btmtk_hci_wmt_evt and read its op/flag fields     without checking the event is long enough to contain them, unlike btmtk.c. The FUNC_CTRL case then further     casts to struct btmtk_hci_wmt_evt_funcc and reads its 2-byte status field, again without a length check.
    Firmware that sends a short or malformed WMT event makes both drivers read past the end of the received     SKB. Mirror btmtk.c: validate the base WMT header with skb_pull_data() before touching any of its fields,     and when a FUNC_CTRL event turns out to be the short, header-only form (a plain enable/disable ack with no     status word), decode the result from the header's own flag byte instead (0 = success, otherwise failure).
    Verified setup on MT7920, MT7921, MT7922 and MT7925: no regression. (CVE-2026-98292)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
376443	Ubuntu 24.04 LTS / 26.04 LTS : Linux kernel vulnerabilities (USN-8959-1)	Nessus	Ubuntu Local Security Checks	Local	high
376285	SUSE SLED15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:5091-1)	Nessus	SuSE Local Security Checks	Local	critical
363324	Linux Distros Unpatched Vulnerability : CVE-2026-98292	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-98292

low

Tenable Plugins

high

critical

medium