All vulnerabilities
CVE-2026-98731

Linux: Bluetooth: btintel_pcie: fix plen overflow in btintel_pcie_recv_frame()

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.21%Chance of exploitation activity in the next 30 days, higher than 10% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in7dbeb6935ac331b0cba6c41cabd8e9d02d5f64eaFixed versionCVE List
Published18 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 7dbeb6935ac331b0cba6c41cabd8e9d02d5f64eaLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btintel_pcie: fix plen overflow in btintel_pcie_recv_frame()

plen is u16 and computed as HDR_SIZE + dlen. For ACL/ISO frames dlen is a 16-bit field, so a value >= 0xFFFC wraps the sum, bypassing the "skb->len < plen" check and letting skb_trim() truncate the packet.

Widen plen to u32 so the addition cannot wrap.

Text from CVE List

Affected versions 10

  • Linuxaffected: c2b636b3f788d10486a6691ad6dd3ec4c93bd78e before c3a3842c109ac130c6db3aa0014cc8cd344928adCVE List
  • Linuxaffected: c2b636b3f788d10486a6691ad6dd3ec4c93bd78e before c3b5e6da4ba6485bffda9753d8339c28855207aaCVE List
  • Linuxaffected: c2b636b3f788d10486a6691ad6dd3ec4c93bd78e before b2cb5ea1dc8cf829816370fc1399e6a1d2d1bca9CVE List
  • Linuxaffected: c2b636b3f788d10486a6691ad6dd3ec4c93bd78e before 7dbeb6935ac331b0cba6c41cabd8e9d02d5f64eaCVE List
  • Linuxaffected: 6.10CVE List
  • Linuxunaffected: all versions before 6.10CVE List
  • Linuxunaffected: 6.12.113 through 6.12.*CVE List
  • Linuxunaffected: 6.18.56 through 6.18.*CVE List
  • Linuxunaffected: 7.2.10 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 4