CVE-2026-97976: Bluetooth: btintel_pcie: validate packet_len before skb_put_data
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: btintelpcie: validate packetlen before skbputdata
btintelpciesubmitrxwork() reads packetlen from rfhhdr without checking if it exceeds the RX buffer size. An oversized packetlen can lead to an out-of-bounds read in skbputdata().
Validate packetlen to ensure it is non-zero and does not exceed BTINTELPCIEBUFFERSIZE - sizeof(rfhhdr), logging an error when invalid.
This issue was reported by Claude Mythos. It can be simulated either by using customized firmware configured to return an invalid packetlen or by modifying rfhhdr->packetlen in the driver before calling btintelpciesubmitrxwork().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In btintel_pcie_submit_rx_work(), validate that rfh_hdr->packet_len is non-zero and does not exceed BTINTEL_PCIE_BUFFER_SIZE - sizeof(*rfh_hdr) before passing the data to skb_put_data().
Event History
Frequently Asked Questions
What conditions are required to trigger the out-of-bounds read?
The receive header must contain a packet_len value that is zero or exceeds BTINTEL_PCIE_BUFFER_SIZE minus the receive-header size. The issue was demonstrated using customized firmware that returns an invalid length, or by modifying the driver's rfh_hdr->packet_len before btintel_pcie_submit_rx_work() runs.
Which systems are realistically exposed?
Exposure is limited to Linux kernel systems using the btintel_pcie Bluetooth receive path and receiving malformed packet-length data. The supplied information identifies customized firmware as a way to generate the invalid value.
How can I determine whether the invalid input is being encountered?
The resolved code logs an error when packet_len is invalid. Review kernel logs for errors associated with invalid packet lengths in the btintel_pcie receive path.