All vulnerabilities
CVE-2026-97976

Linux: Bluetooth: btintel_pcie: validate packet_len before skb_put_data

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 5% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in73a50c636425cb9f7ab647b5a97bd14dd5610076Also 46884c0f92708f1d218fc94d88800227a19b52f8, 6436e1b5331b1aebf905c13e0880a37032719b75CVE List
Published25 Sep 2026Updated 19 Oct 2026CVE List

What fixes it

  • 73a50c636425cb9f7ab647b5a97bd14dd5610076LinuxCVE List
  • 46884c0f92708f1d218fc94d88800227a19b52f8LinuxCVE List
  • 6436e1b5331b1aebf905c13e0880a37032719b75LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btintel_pcie: validate packet_len before skb_put_data

btintel_pcie_submit_rx_work() reads packet_len from rfh_hdr without checking if it exceeds the RX buffer size. An oversized packet_len can lead to an out-of-bounds read in skb_put_data().

Validate packet_len to ensure it is non-zero and does not exceed BTINTEL_PCIE_BUFFER_SIZE - sizeof(*rfh_hdr), logging an error when invalid.

This issue was reported by Claude Mythos. It can be simulated either by using customized firmware configured to return an invalid packet_len or by modifying rfh_hdr->packet_len in the driver before calling btintel_pcie_submit_rx_work().

Text from CVE List

Affected versions 10

  • Linuxaffected: c2b636b3f788d10486a6691ad6dd3ec4c93bd78e before ab0159b1f7214ce9bad9862751e4553e635a21b1CVE List
  • Linuxaffected: c2b636b3f788d10486a6691ad6dd3ec4c93bd78e before 73a50c636425cb9f7ab647b5a97bd14dd5610076CVE List
  • Linuxaffected: c2b636b3f788d10486a6691ad6dd3ec4c93bd78e before 46884c0f92708f1d218fc94d88800227a19b52f8CVE List
  • Linuxaffected: c2b636b3f788d10486a6691ad6dd3ec4c93bd78e before 6436e1b5331b1aebf905c13e0880a37032719b75CVE List
  • Linuxaffected: 6.10CVE List
  • Linuxunaffected: all versions before 6.10CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2.7 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 4