Executive brief
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: btintel: bound firmware ID by TLV length
The firmware ID is treated as a NUL-terminated string even though the TLV length is its only boundary. If the value does not contain a NUL terminator, snprintf() can read beyond the received response.
Limit the conversion to the advertised TLV value length.