CVE-2026-97976
Received Received - Intake

Bluetooth: btintel_pcie Out-of-Bounds Read in RX Packet Handling

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel_pcie: validate packet_len before skb_put_data btintel_pcie_submit_rx_work() reads packet_len from rfh_hdr without checking if it exceeds the RX buffer size. An oversized packet_len can lead to an out-of-bounds read in skb_put_data(). Validate packet_len to ensure it is non-zero and does not exceed BTINTEL_PCIE_BUFFER_SIZE - sizeof(*rfh_hdr), logging an error when invalid. This issue was reported by Claude Mythos. It can be simulated either by using customized firmware configured to return an invalid packet_len or by modifying rfh_hdr->packet_len in the driver before calling btintel_pcie_submit_rx_work().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-97976
EUVD
EUVD-2026-86630

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Bluetooth vulnerability in the Linux kernel affecting the btintel_pcie driver. It involves an out-of-bounds read issue where packet_len from rfh_hdr is not validated against the RX buffer size before being used in skb_put_data(). An attacker could exploit this by sending oversized packets or manipulating packet_len to trigger memory corruption.

Detection Guidance

This vulnerability involves an out-of-bounds read in the Linux kernel's Bluetooth driver (btintel_pcie). Detection requires kernel-level inspection. Check if your kernel version includes the fix by examining the btintel_pcie.c file for packet_len validation logic. Use commands like 'uname -a' to check kernel version and 'grep -r "packet_len" /path/to/kernel/drivers/bluetooth/' to verify the fix.

Impact Analysis

This vulnerability could allow an attacker to cause a denial of service or potentially execute arbitrary code on affected systems. It may lead to system crashes, data corruption, or unauthorized access if exploited via Bluetooth communication.

Mitigation Strategies

Apply the latest kernel update from your Linux distribution to ensure the fix is included. If a patch is unavailable, disable the btintel_pcie driver by blacklisting it or recompile the kernel with the fix. Monitor vendor advisories for updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97976. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart