CVE-2026-98730
Received Received - Intake

Bluetooth Stack Buffer Overflow in Linux Kernel

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel_pcie: reject oversized TX packets in send_frame() btintel_pcie_send_frame() eventually copies skb->data into a fixed BTINTEL_PCIE_BUFFER_SIZE (4096) DMA buffer via memcpy() in btintel_pcie_prepare_tx(), with a 4-byte PCIe type header prepended. A user-space process with HCI_CHANNEL_USER access can inject an oversized packet and overflow the buffer. Reject packets larger than BTINTEL_PCIE_BUFFER_SIZE - BTINTEL_PCIE_HCI_TYPE_LEN on entry.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-19
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98730
EUVD
EUVD-2026-103815

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
Linux Linux 6e65a09f927566f257322358d429b267548473eb
Linux Linux 6e65a09f927566f257322358d429b267548473eb
Linux Linux 6e65a09f927566f257322358d429b267548473eb
Linux Linux 6e65a09f927566f257322358d429b267548473eb
Linux Linux 6.10

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a buffer overflow vulnerability in the Linux kernel's Bluetooth driver for Intel PCIe devices. A user-space process with HCI_CHANNEL_USER access can send oversized Bluetooth packets that exceed the fixed 4096-byte DMA buffer, causing a memory overflow when the kernel copies the packet data.

Detection Guidance

This vulnerability involves oversized Bluetooth packets being processed by the Linux kernel's btintel_pcie driver. Detection requires checking for kernel logs or system crashes related to Bluetooth operations. Monitor dmesg or journalctl for errors like buffer overflow warnings or segmentation faults in btintel_pcie modules.

Impact Analysis

An attacker with local access could exploit this to crash the system, execute arbitrary code with kernel privileges, or cause denial-of-service conditions. Remote exploitation is unlikely as it requires HCI_CHANNEL_USER access.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it is a low-level kernel buffer overflow issue in Bluetooth functionality. However, if exploited, it could lead to unauthorized code execution or data corruption, potentially impacting data integrity and confidentiality. This might indirectly affect compliance if sensitive data is involved.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for CVE-2026-98730. Disable Bluetooth functionality if not required, or restrict access to HCI_CHANNEL_USER to prevent malicious packet injection. Monitor vendor advisories for kernel updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98730. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart