{"schema":"threatline.record/2","record":{"id":"CVE-2026-97976","aliases":[],"summary":"Bluetooth: btintel_pcie: validate packet_len before skb_put_data","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btintel_pcie: validate packet_len before skb_put_data\n\nbtintel_pcie_submit_rx_work() reads packet_len from rfh_hdr without\nchecking if it exceeds the RX buffer size. An oversized packet_len\ncan lead to an out-of-bounds read in skb_put_data().\n\nValidate packet_len to ensure it is non-zero and does not exceed\nBTINTEL_PCIE_BUFFER_SIZE - sizeof(*rfh_hdr), logging an error when\ninvalid.\n\nThis issue was reported by Claude Mythos. It can be simulated either by\nusing customized firmware configured to return an invalid packet_len or\nby modifying rfh_hdr->packet_len in the driver before calling\nbtintel_pcie_submit_rx_work().","categories":["Operating systems"],"product":"Linux","vendor":"Linux","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97976","source_modified_at":"2026-10-19T09:11:43.531Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"Linux","vendor":"Linux","versions":[{"version":"c2b636b3f788d10486a6691ad6dd3ec4c93bd78e","lessThan":"ab0159b1f7214ce9bad9862751e4553e635a21b1","status":"affected","versionType":"git"},{"version":"c2b636b3f788d10486a6691ad6dd3ec4c93bd78e","lessThan":"73a50c636425cb9f7ab647b5a97bd14dd5610076","status":"affected","versionType":"git"},{"version":"c2b636b3f788d10486a6691ad6dd3ec4c93bd78e","lessThan":"46884c0f92708f1d218fc94d88800227a19b52f8","status":"affected","versionType":"git"},{"version":"c2b636b3f788d10486a6691ad6dd3ec4c93bd78e","lessThan":"6436e1b5331b1aebf905c13e0880a37032719b75","status":"affected","versionType":"git"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97976","source_modified_at":"2026-10-19T09:11:43.531Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"Linux","vendor":"Linux","versions":[{"version":"6.10","status":"affected"},{"version":"0","lessThan":"6.10","status":"unaffected","versionType":"semver"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","status":"unaffected","versionType":"semver"},{"version":"7.3","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}],"defaultStatus":"affected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97976","source_modified_at":"2026-10-19T09:11:43.531Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"73a50c636425cb9f7ab647b5a97bd14dd5610076","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97976","source_modified_at":"2026-10-19T09:11:43.531Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"46884c0f92708f1d218fc94d88800227a19b52f8","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97976","source_modified_at":"2026-10-19T09:11:43.531Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"6436e1b5331b1aebf905c13e0880a37032719b75","basis":"first unaffected version stated in the CVE record"}],"cvss":null,"severity":null,"kev":{"listed":false},"epss":{"probability":0.00168,"percentile":0.05755,"score_date":"2026-10-23"},"published_at":"2026-09-25T10:23:14.596Z","modified_at":"2026-10-19T09:11:43.531Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-97976","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-19T09:11:43.531Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97976","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://git.kernel.org/stable/c/ab0159b1f7214ce9bad9862751e4553e635a21b1"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/73a50c636425cb9f7ab647b5a97bd14dd5610076"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/46884c0f92708f1d218fc94d88800227a19b52f8"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/6436e1b5331b1aebf905c13e0880a37032719b75"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-19T09:11:43.531Z","content_hash":"8b911220fbd541073b9349b49b5df59abad5872ab6cbc5a2dd926c4f8a8f2aae"}}