In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btintel_pcie: reject oversized TX packets in send_frame()

btintel_pcie_send_frame() eventually copies skb->data into a fixed
BTINTEL_PCIE_BUFFER_SIZE (4096) DMA buffer via memcpy() in
btintel_pcie_prepare_tx(), with a 4-byte PCIe type header prepended.
A user-space process with HCI_CHANNEL_USER access can inject an
oversized packet and overflow the buffer.

Reject packets larger than
BTINTEL_PCIE_BUFFER_SIZE - BTINTEL_PCIE_HCI_TYPE_LEN on entry.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
6e65a09f927566f257322358d429b267548473eb affected < 3d6ba6be9bef13edcd4ad74f7cfdd0c34db4d2bc
6e65a09f927566f257322358d429b267548473eb affected < 84df222de86eabed543361025ed54ce838c0b573
6e65a09f927566f257322358d429b267548473eb affected < 9806a748f9ab223b733624367b6ddda77fb9450e
6e65a09f927566f257322358d429b267548473eb affected < f771f96557a4d953a7e4d045870547271e36e819
Linux Linux affected
Version Status Constraints
6.10 affected —
0 unaffected < 6.10
6.12.113 unaffected ≤ 6.12.*
6.18.56 unaffected ≤ 6.18.*
7.2.10 unaffected ≤ 7.2.*
7.3-rc6 unaffected ≤ *

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/3d6ba6be9bef13edcd4ad74f7cfdd0c34db4d2bc cve-icon cve-icon
https://git.kernel.org/stable/c/84df222de86eabed543361025ed54ce838c0b573 cve-icon cve-icon
https://git.kernel.org/stable/c/9806a748f9ab223b733624367b6ddda77fb9450e cve-icon cve-icon
https://git.kernel.org/stable/c/f771f96557a4d953a7e4d045870547271e36e819 cve-icon cve-icon
History

Sun, 18 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-120

Sun, 18 Oct 2026 16:00:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel_pcie: reject oversized TX packets in send_frame() btintel_pcie_send_frame() eventually copies skb->data into a fixed BTINTEL_PCIE_BUFFER_SIZE (4096) DMA buffer via memcpy() in btintel_pcie_prepare_tx(), with a 4-byte PCIe type header prepended. A user-space process with HCI_CHANNEL_USER access can inject an oversized packet and overflow the buffer. Reject packets larger than BTINTEL_PCIE_BUFFER_SIZE - BTINTEL_PCIE_HCI_TYPE_LEN on entry.
Title Bluetooth: btintel_pcie: reject oversized TX packets in send_frame()
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-10-18T15:47:07.600Z

Reserved: 2026-09-25T10:25:14.366Z

Link: CVE-2026-98730

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-18T16:17:26.623

Modified: 2026-10-18T16:17:26.623

Link: CVE-2026-98730

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-18T19:15:14Z

Weaknesses