UBUNTU-CVE-2026-98296: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: validate TX skb length in sendsync btintelpciepreparetx() copies skb->len bytes into a fixed BTINTELPCIEBUFFERSIZE (4096) DMA slot via an unchecked memcpy. Oversized packets are currently rejected only in btintelpciesendframe(); any future caller of btintelpciesendsync() would silently overflow the DMA buffer. Add the bounds check in btintelpciesendsync() itself, right before skbpush() and the DMA copy.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Add a bounds check in btintel_pcie_send_sync() before skb_push() and the DMA copy, rejecting packets whose skb->len exceeds BTINTEL_PCIE_BUFFER_SIZE (4096).
Event History
Frequently Asked Questions
What condition is required for the overflow to occur?
An oversized socket buffer must reach btintel_pcie_send_sync(), where its length would otherwise be copied into a fixed 4096-byte DMA slot without a bounds check. The existing btintel_pcie_send_frame() path already rejects oversized packets; the issue concerns callers that reach send_sync() without that protection.
Which Ubuntu kernel package families should be reviewed?
The affected software list names ubuntu/linux-riscv, ubuntu/linux-realtime, ubuntu/linux-hwe-edge, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-azure-fde, ubuntu/linux-gke, and ubuntu/linux-aws-5.0. The provided data does not include fixed package versions.
What does the resolution change to prevent this issue?
The resolution adds a length check in btintel_pcie_send_sync() itself, immediately before skb_push() and the DMA copy. This ensures oversized buffers are rejected at the common send_sync() path rather than relying on individual callers to validate them.