CVE-2026-98296: Bluetooth: btintel_pcie: validate TX skb length in send_sync

Published Oct 6, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btintelpcie: validate TX skb length in sendsync

btintelpciepreparetx() copies skb->len bytes into a fixed BTINTELPCIEBUFFERSIZE (4096) DMA slot via an unchecked memcpy. Oversized packets are currently rejected only in btintelpciesendframe(); any future caller of btintelpciesendsync() would silently overflow the DMA buffer.

Add the bounds check in btintelpciesendsync() itself, right before skbpush() and the DMA copy.

Affected Software

1 affected component

Linux Linux kernel

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Compensating control
Add a bounds check in btintel_pcie_send_sync() to validate the TX skb length against BTINTEL_PCIE_BUFFER_SIZE (4096) and reject oversized packets before skb_push() and the DMA copy.

Event History

Oct 6, 2026

CVE Published

via MITRE·08:45 AM

Data Sourced

via MITRE·08:45 AM

Description

Data Sourced

via NVD·09:18 AM

Description

Frequently Asked Questions

Is the currently described transmit path protected from oversized packets?

Oversized packets are rejected by btintel_pcie_send_frame(). The risk described is that a future caller could invoke btintel_pcie_send_sync() directly and bypass that existing validation.

What condition is required for the DMA buffer overflow to occur?

btintel_pcie_send_sync() must receive an skb whose length exceeds the fixed 4096-byte BTINTEL_PCIE_BUFFER_SIZE DMA slot. Without validation in that function, the unchecked memcpy can copy the oversized skb into the fixed-size buffer.

What should maintainers verify when assessing their kernel source?

Verify that btintel_pcie_send_sync() performs a TX skb length bounds check immediately before skb_push() and the DMA copy. Validation only in btintel_pcie_send_frame() does not protect direct callers of btintel_pcie_send_sync().

CVE-2026-98296: Bluetooth: btintel_pcie: validate TX skb length in send_sync

Affected Software

Remediation

Event History

Frequently Asked Questions

Is the currently described transmit path protected from oversized packets?

What condition is required for the DMA buffer overflow to occur?

What should maintainers verify when assessing their kernel source?

Company

Resources

Contact

Frequently Asked Questions

Is the currently described transmit path protected from oversized packets?

What condition is required for the DMA buffer overflow to occur?

What should maintainers verify when assessing their kernel source?