All vulnerabilities
CVE-2026-98730

Linux: Bluetooth: btintel_pcie: reject oversized TX packets in send_frame()

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 5% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in3d6ba6be9bef13edcd4ad74f7cfdd0c34db4d2bcAlso 84df222de86eabed543361025ed54ce838c0b573, 9806a748f9ab223b733624367b6ddda77fb9450eCVE List
Published18 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 3d6ba6be9bef13edcd4ad74f7cfdd0c34db4d2bcLinuxCVE List
  • 84df222de86eabed543361025ed54ce838c0b573LinuxCVE List
  • 9806a748f9ab223b733624367b6ddda77fb9450eLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btintel_pcie: reject oversized TX packets in send_frame()

btintel_pcie_send_frame() eventually copies skb->data into a fixed BTINTEL_PCIE_BUFFER_SIZE (4096) DMA buffer via memcpy() in btintel_pcie_prepare_tx(), with a 4-byte PCIe type header prepended. A user-space process with HCI_CHANNEL_USER access can inject an oversized packet and overflow the buffer.

Reject packets larger than BTINTEL_PCIE_BUFFER_SIZE - BTINTEL_PCIE_HCI_TYPE_LEN on entry.

Text from CVE List

Affected versions 10

  • Linuxaffected: 6e65a09f927566f257322358d429b267548473eb before 3d6ba6be9bef13edcd4ad74f7cfdd0c34db4d2bcCVE List
  • Linuxaffected: 6e65a09f927566f257322358d429b267548473eb before 84df222de86eabed543361025ed54ce838c0b573CVE List
  • Linuxaffected: 6e65a09f927566f257322358d429b267548473eb before 9806a748f9ab223b733624367b6ddda77fb9450eCVE List
  • Linuxaffected: 6e65a09f927566f257322358d429b267548473eb before f771f96557a4d953a7e4d045870547271e36e819CVE List
  • Linuxaffected: 6.10CVE List
  • Linuxunaffected: all versions before 6.10CVE List
  • Linuxunaffected: 6.12.113 through 6.12.*CVE List
  • Linuxunaffected: 6.18.56 through 6.18.*CVE List
  • Linuxunaffected: 7.2.10 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 4