CVE-2026-98730: Bluetooth: btintel_pcie: reject oversized TX packets in send_frame()
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: btintelpcie: reject oversized TX packets in sendframe()
btintelpciesendframe() eventually copies skb->data into a fixed BTINTELPCIEBUFFERSIZE (4096) DMA buffer via memcpy() in btintelpciepreparetx(), with a 4-byte PCIe type header prepended. A user-space process with HCICHANNELUSER access can inject an oversized packet and overflow the buffer.
Reject packets larger than BTINTELPCIEBUFFERSIZE - BTINTELPCIEHCITYPELEN on entry.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.113 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.56 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.10
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker needs access to an HCI socket using HCI_CHANNEL_USER, which permits injection of Bluetooth HCI packets from user space. The provided information does not establish that an unprivileged local user has this access by default.
What condition triggers the overflow?
The vulnerable transmit path copies packet data into a fixed 4096-byte DMA buffer after adding a 4-byte PCIe type header. A packet larger than BTINTEL_PCIE_BUFFER_SIZE minus BTINTEL_PCIE_HCI_TYPE_LEN can overflow that buffer.
What mitigation is available before applying the fix?
Restrict access to HCI_CHANNEL_USER so that untrusted user-space processes cannot inject HCI packets. This removes the stated attacker capability needed to reach the vulnerable send path.