Riskcovery

CVE-2026-98730

Bluetooth: btintel_pcie: reject oversized TX packets in send_frame()

State
Published
Severity
Not scored
Published
Oct 18, 2026
Updated
Oct 19, 2026
Reserved
Sep 25, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btintel_pcie: reject oversized TX packets in send_frame()

btintel_pcie_send_frame() eventually copies skb->data into a fixed BTINTEL_PCIE_BUFFER_SIZE (4096) DMA buffer via memcpy() in btintel_pcie_prepare_tx(), with a 4-byte PCIe type header prepended. A user-space process with HCI_CHANNEL_USER access can inject an oversized packet and overflow the buffer.

Reject packets larger than BTINTEL_PCIE_BUFFER_SIZE - BTINTEL_PCIE_HCI_TYPE_LEN on entry.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 6e65a09f927566f257322358d429b267548473eb to before 3d6ba6be9bef13edcd4ad74f7cfdd0c34db4d2bcAffected
  • 6e65a09f927566f257322358d429b267548473eb to before 84df222de86eabed543361025ed54ce838c0b573Affected
  • 6e65a09f927566f257322358d429b267548473eb to before 9806a748f9ab223b733624367b6ddda77fb9450eAffected
  • 6e65a09f927566f257322358d429b267548473eb to before f771f96557a4d953a7e4d045870547271e36e819Affected
LinuxLinux
  • 6.10Affected
  • before 6.10Not affected
  • 6.12.113 through 6.12.*Not affected
  • 6.18.56 through 6.18.*Not affected
  • 7.2.10 through 7.2.*Not affected
  • 7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.