CVE-2026-98296: Bluetooth: btintel_pcie: validate TX skb length in send_sync
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: btintelpcie: validate TX skb length in sendsync
btintelpciepreparetx() copies skb->len bytes into a fixed BTINTELPCIEBUFFERSIZE (4096) DMA slot via an unchecked memcpy. Oversized packets are currently rejected only in btintelpciesendframe(); any future caller of btintelpciesendsync() would silently overflow the DMA buffer.
Add the bounds check in btintelpciesendsync() itself, right before skbpush() and the DMA copy.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Add a bounds check in btintel_pcie_send_sync() before skb_push() and the DMA copy, rejecting packets whose skb->len exceeds BTINTEL_PCIE_BUFFER_SIZE (4096).
Event History
Frequently Asked Questions
Is the currently described transmit path protected from oversized packets?
Oversized packets are rejected by btintel_pcie_send_frame(). The risk described is that a future caller could invoke btintel_pcie_send_sync() directly and bypass that existing validation.
What condition is required for the DMA buffer overflow to occur?
btintel_pcie_send_sync() must receive an skb whose length exceeds the fixed 4096-byte BTINTEL_PCIE_BUFFER_SIZE DMA slot. Without validation in that function, the unchecked memcpy can copy the oversized skb into the fixed-size buffer.
What should maintainers verify when assessing their kernel source?
Verify that btintel_pcie_send_sync() performs a TX skb length bounds check immediately before skb_push() and the DMA copy. Validation only in btintel_pcie_send_frame() does not protect direct callers of btintel_pcie_send_sync().