CVE-2026-98296Bluetooth: btintel_pcie: validate TX skb length in send_sync
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel_pcie: validate TX skb length in send_sync btintel_pcie_prepare_tx() copies skb->len bytes into a fixed BTINTEL_PCIE_BUFFER_SIZE (4096) DMA slot via an unchecked memcpy. Oversized packets are currently rejected only in btintel_pcie_send_frame(); any future caller of btintel_pcie_send_sync() would silently overflow the DMA buffer. Add the bounds check in btintel_pcie_send_sync() itself, right before skb_push() and the DMA copy.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 6, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 6e65a09f927566f257322358d429b267548473eb before 84f353256e170dc4865d45007d1bc446ed566da7; from 6e65a09f927566f257322358d429b267548473eb before c298a61e18029401486c40298a50fbeea7e7b663; 6e65a09f927566f257322358d429b267548473eb builds before 4b837ebd0ea21ae5cc26f02dc042edc6fe7b46b9 | CNA record |
References
- https://git.kernel.org/stable/c/84f353256e170dc4865d45007d1bc446ed566da7
- https://git.kernel.org/stable/c/c298a61e18029401486c40298a50fbeea7e7b663
- https://git.kernel.org/stable/c/4b837ebd0ea21ae5cc26f02dc042edc6fe7b46b9
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.