CVE-2026-98731: Bluetooth: btintel_pcie: fix plen overflow in btintel_pcie_recv_frame()

Q: What traffic is required to trigger the flaw?

An attacker would need to cause the affected Bluetooth Intel PCIe receive path to process an ACL or ISO frame whose 16-bit data-length field is at least 0xFFFC. That value causes the header-size-plus-length calculation to wrap when stored in a 16-bit variable.

Q: What is the observable effect of a malicious frame?

The wrapped length can bypass the receive-length validation check and cause skb_trim() to truncate the packet. The provided information does not establish impact beyond this incorrect packet truncation.

Q: How can I determine whether a system needs remediation?

Determine whether the system is running a Linux kernel containing the btintel_pcie receive-frame implementation and uses the affected Intel Bluetooth PCIe path. The supplied information does not identify affected or fixed kernel version numbers; compare the kernel source or downstream patch state with the referenced stable commits.

Published Oct 18, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btintelpcie: fix plen overflow in btintelpcierecvframe()

plen is u16 and computed as HDRSIZE + dlen. For ACL/ISO frames dlen is a 16-bit field, so a value >= 0xFFFC wraps the sum, bypassing the "skb->len < plen" check and letting skbtrim() truncate the packet.

Widen plen to u32 so the addition cannot wrap.

Affected Software

1 affected component

Linux Linux kernel

Event History

Oct 18, 2026

CVE Published

via MITRE·03:47 PM

Data Sourced

via MITRE·03:47 PM

Description

Data Sourced

via NVD·04:17 PM

Description

Frequently Asked Questions

What traffic is required to trigger the flaw?

An attacker would need to cause the affected Bluetooth Intel PCIe receive path to process an ACL or ISO frame whose 16-bit data-length field is at least 0xFFFC. That value causes the header-size-plus-length calculation to wrap when stored in a 16-bit variable.

What is the observable effect of a malicious frame?

The wrapped length can bypass the receive-length validation check and cause skb_trim() to truncate the packet. The provided information does not establish impact beyond this incorrect packet truncation.

How can I determine whether a system needs remediation?

Determine whether the system is running a Linux kernel containing the btintel_pcie receive-frame implementation and uses the affected Intel Bluetooth PCIe path. The supplied information does not identify affected or fixed kernel version numbers; compare the kernel source or downstream patch state with the referenced stable commits.

CVE-2026-98731: Bluetooth: btintel_pcie: fix plen overflow in btintel_pcie_recv_frame()

Affected Software

Event History

Frequently Asked Questions

What traffic is required to trigger the flaw?

What is the observable effect of a malicious frame?

How can I determine whether a system needs remediation?

Company

Resources

Contact

Frequently Asked Questions

What traffic is required to trigger the flaw?

What is the observable effect of a malicious frame?

How can I determine whether a system needs remediation?