CVE-2026-97976: Bluetooth: btintel_pcie: validate packet_len before skb_put_data
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: btintelpcie: validate packetlen before skbputdata
btintelpciesubmitrxwork() reads packetlen from rfhhdr without checking if it exceeds the RX buffer size. An oversized packetlen can lead to an out-of-bounds read in skbputdata().
Validate packetlen to ensure it is non-zero and does not exceed BTINTELPCIEBUFFERSIZE - sizeof(rfhhdr), logging an error when invalid.
This issue was reported by Claude Mythos. It can be simulated either by using customized firmware configured to return an invalid packetlen or by modifying rfhhdr->packetlen in the driver before calling btintelpciesubmitrxwork().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.111 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.53 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.7 - Compensating control
In btintel_pcie_submit_rx_work(), validate packet_len before calling skb_put_data(): require it to be non-zero and no greater than BTINTEL_PCIE_BUFFER_SIZE - sizeof(*rfh_hdr), and log an error when invalid.
Event History
Frequently Asked Questions
What conditions are required to trigger the out-of-bounds read?
The receive header must contain a packet_len value that is zero or exceeds BTINTEL_PCIE_BUFFER_SIZE minus the receive-header size. The issue was demonstrated using customized firmware that returns an invalid length, or by modifying the driver's rfh_hdr->packet_len before btintel_pcie_submit_rx_work() runs.
Which systems are realistically exposed?
Exposure is limited to Linux kernel systems using the btintel_pcie Bluetooth receive path and receiving malformed packet-length data. The supplied information identifies customized firmware as a way to generate the invalid value.
How can I determine whether the invalid input is being encountered?
The resolved code logs an error when packet_len is invalid. Review kernel logs for errors associated with invalid packet lengths in the btintel_pcie receive path.