UBUNTU-CVE-2026-98730: High severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: reject oversized TX packets in sendframe() btintelpciesendframe() eventually copies skb->data into a fixed BTINTELPCIEBUFFERSIZE (4096) DMA buffer via memcpy() in btintelpciepreparetx(), with a 4-byte PCIe type header prepended. A user-space process with HCICHANNELUSER access can inject an oversized packet and overflow the buffer. Reject packets larger than BTINTELPCIEBUFFERSIZE - BTINTELPCIEHCITYPELEN on entry.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-aws-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.18~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fde-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1019.19~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.19~24.04.1 - Upgrade
Upgrade
ubuntu/linux-oracle-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1016.18~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-43.43.1~24.04.2 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-43.43 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1017.18 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 7.0.0-1020.21 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 7.0.0-1019.19 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1017.19 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 7.0.0-1010.11 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1018.18 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1018.18 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 7.0.0-43.43.1 - Compensating control
In btintel_pcie_send_frame(), reject TX packets larger than BTINTEL_PCIE_BUFFER_SIZE - BTINTEL_PCIE_HCI_TYPE_LEN (4096 - 4 = 4092 bytes) before copying skb->data into the DMA buffer.
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs local access and high privileges, specifically the ability to use the Bluetooth HCI user channel (HCI_CHANNEL_USER). The vulnerable path is in the btintel_pcie driver, so systems without the relevant Intel PCIe Bluetooth device and driver exposure are not affected through this path.
What packet size triggers the vulnerable condition?
The issue is triggered by a transmitted packet larger than the 4096-byte DMA buffer after accounting for the 4-byte PCIe HCI type header. The fix rejects packets larger than BTINTEL_PCIE_BUFFER_SIZE minus BTINTEL_PCIE_HCI_TYPE_LEN before they reach the memcpy operation.
What is the impact if exploitation succeeds?
An oversized packet can overflow a fixed DMA buffer during transmit processing. The reported impacts include high confidentiality, integrity, and availability effects within the vulnerable component.