CVE-2026-98730: Bluetooth: btintel_pcie: reject oversized TX packets in send_frame()
Published Oct 18, 2026
·Updated
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: btintelpcie: reject oversized TX packets in sendframe()
btintelpciesendframe() eventually copies skb->data into a fixed BTINTELPCIEBUFFERSIZE (4096) DMA buffer via memcpy() in btintelpciepreparetx(), with a 4-byte PCIe type header prepended. A user-space process with HCICHANNELUSER access can inject an oversized packet and overflow the buffer.
Reject packets larger than BTINTELPCIEBUFFERSIZE - BTINTELPCIEHCITYPELEN on entry.
Affected Software
1 affected component
Linux Linux kernel
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Update btintel_pcie_send_frame() to reject TX packets larger than BTINTEL_PCIE_BUFFER_SIZE - BTINTEL_PCIE_HCI_TYPE_LEN before copying skb->data into the DMA buffer.
Event History
Oct 18, 2026
CVE Published
via MITRE·03:47 PM
Data Sourced
via MITRE·03:47 PM
Description
Data Sourced
via NVD·04:17 PM
Description