CVE-2025-38099 Bluetooth: Disable SCO support if READ_VOICE_SETTING is unsupported/broken

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Bluetooth Vulnerabilities CVE-2024-26903 and CVE-2025-37792 Addressed Two Bluetooth vulnerabilities have been reported, CVE-2024-26903 and CVE-2025-37792. CVE-2024-26903, related to rfcomm, addresses a null pointer dereference issue, while CVE-2025-37792 focuses on preventing a potential NULL dereference in btrtl. Both vulnerabilities were published on February 18, 2026, with prior publication dates in 2024 and 2025 respectively. 10 sources 48