Riskcovery

CVE-2026-97976

Bluetooth: btintel_pcie: validate packet_len before skb_put_data

State
Published
Severity
Not scored
Published
Sep 25, 2026
Updated
Oct 19, 2026
Reserved
Sep 25, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btintel_pcie: validate packet_len before skb_put_data

btintel_pcie_submit_rx_work() reads packet_len from rfh_hdr without checking if it exceeds the RX buffer size. An oversized packet_len can lead to an out-of-bounds read in skb_put_data().

Validate packet_len to ensure it is non-zero and does not exceed BTINTEL_PCIE_BUFFER_SIZE - sizeof(*rfh_hdr), logging an error when invalid.

This issue was reported by Claude Mythos. It can be simulated either by using customized firmware configured to return an invalid packet_len or by modifying rfh_hdr->packet_len in the driver before calling btintel_pcie_submit_rx_work().

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • c2b636b3f788d10486a6691ad6dd3ec4c93bd78e to before ab0159b1f7214ce9bad9862751e4553e635a21b1Affected
  • c2b636b3f788d10486a6691ad6dd3ec4c93bd78e to before 73a50c636425cb9f7ab647b5a97bd14dd5610076Affected
  • c2b636b3f788d10486a6691ad6dd3ec4c93bd78e to before 46884c0f92708f1d218fc94d88800227a19b52f8Affected
  • c2b636b3f788d10486a6691ad6dd3ec4c93bd78e to before 6436e1b5331b1aebf905c13e0880a37032719b75Affected
LinuxLinux
  • 6.10Affected
  • before 6.10Not affected
  • 6.12.111 through 6.12.*Not affected
  • 6.18.53 through 6.18.*Not affected
  • 7.2.7 through 7.2.*Not affected
  • 7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.