Riskcovery

CVE-2026-98296

Bluetooth: btintel_pcie: validate TX skb length in send_sync

State
Published
Severity
Not scored
Published
Oct 6, 2026
Updated
Oct 19, 2026
Reserved
Sep 25, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btintel_pcie: validate TX skb length in send_sync

btintel_pcie_prepare_tx() copies skb->len bytes into a fixed BTINTEL_PCIE_BUFFER_SIZE (4096) DMA slot via an unchecked memcpy. Oversized packets are currently rejected only in btintel_pcie_send_frame(); any future caller of btintel_pcie_send_sync() would silently overflow the DMA buffer.

Add the bounds check in btintel_pcie_send_sync() itself, right before skb_push() and the DMA copy.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 6e65a09f927566f257322358d429b267548473eb to before 84f353256e170dc4865d45007d1bc446ed566da7Affected
  • 6e65a09f927566f257322358d429b267548473eb to before c298a61e18029401486c40298a50fbeea7e7b663Affected
  • 6e65a09f927566f257322358d429b267548473eb to before 4b837ebd0ea21ae5cc26f02dc042edc6fe7b46b9Affected
LinuxLinux
  • 6.10Affected
  • before 6.10Not affected
  • 6.18.54 through 6.18.*Not affected
  • 7.2.8 through 7.2.*Not affected
  • 7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.