CVE-2026-98731: Bluetooth: btintel_pcie: fix plen overflow in btintel_pcie_recv_frame()
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: btintelpcie: fix plen overflow in btintelpcierecvframe()
plen is u16 and computed as HDRSIZE + dlen. For ACL/ISO frames dlen is a 16-bit field, so a value >= 0xFFFC wraps the sum, bypassing the "skb->len < plen" check and letting skbtrim() truncate the packet.
Widen plen to u32 so the addition cannot wrap.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.113 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.56 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.10 - Compensating control
In btintel_pcie_recv_frame(), widen plen from u16 to u32 so the HDR_SIZE + dlen addition cannot wrap for ACL/ISO frames.
Event History
Frequently Asked Questions
What traffic is required to trigger the flaw?
An attacker would need to cause the affected Bluetooth Intel PCIe receive path to process an ACL or ISO frame whose 16-bit data-length field is at least 0xFFFC. That value causes the header-size-plus-length calculation to wrap when stored in a 16-bit variable.
What is the observable effect of a malicious frame?
The wrapped length can bypass the receive-length validation check and cause skb_trim() to truncate the packet. The provided information does not establish impact beyond this incorrect packet truncation.
How can I determine whether a system needs remediation?
Determine whether the system is running a Linux kernel containing the btintel_pcie receive-frame implementation and uses the affected Intel Bluetooth PCIe path. The supplied information does not identify affected or fixed kernel version numbers; compare the kernel source or downstream patch state with the referenced stable commits.