Riskcovery

CVE-2026-98731

Bluetooth: btintel_pcie: fix plen overflow in btintel_pcie_recv_frame()

State
Published
Severity
Not scored
Published
Oct 18, 2026
Updated
Oct 19, 2026
Reserved
Sep 25, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btintel_pcie: fix plen overflow in btintel_pcie_recv_frame()

plen is u16 and computed as HDR_SIZE + dlen. For ACL/ISO frames dlen is a 16-bit field, so a value >= 0xFFFC wraps the sum, bypassing the "skb->len < plen" check and letting skb_trim() truncate the packet.

Widen plen to u32 so the addition cannot wrap.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • c2b636b3f788d10486a6691ad6dd3ec4c93bd78e to before c3a3842c109ac130c6db3aa0014cc8cd344928adAffected
  • c2b636b3f788d10486a6691ad6dd3ec4c93bd78e to before c3b5e6da4ba6485bffda9753d8339c28855207aaAffected
  • c2b636b3f788d10486a6691ad6dd3ec4c93bd78e to before b2cb5ea1dc8cf829816370fc1399e6a1d2d1bca9Affected
  • c2b636b3f788d10486a6691ad6dd3ec4c93bd78e to before 7dbeb6935ac331b0cba6c41cabd8e9d02d5f64eaAffected
LinuxLinux
  • 6.10Affected
  • before 6.10Not affected
  • 6.12.113 through 6.12.*Not affected
  • 6.18.56 through 6.18.*Not affected
  • 7.2.10 through 7.2.*Not affected
  • 7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.