CVE-2026-98296
Received Received - Intake

Bluetooth Stack Buffer Overflow in Linux Kernel

Publication date: 2026-10-06

Last updated on: 2026-10-06

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel_pcie: validate TX skb length in send_sync btintel_pcie_prepare_tx() copies skb->len bytes into a fixed BTINTEL_PCIE_BUFFER_SIZE (4096) DMA slot via an unchecked memcpy. Oversized packets are currently rejected only in btintel_pcie_send_frame(); any future caller of btintel_pcie_send_sync() would silently overflow the DMA buffer. Add the bounds check in btintel_pcie_send_sync() itself, right before skb_push() and the DMA copy.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-06
Last Modified
2026-10-06
Generated
2026-10-06
AI Q&A
2026-10-06
EPSS Evaluated
N/A
NVD
CVE-2026-98296
EUVD
EUVD-2026-93281

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
Linux Linux 6e65a09f927566f257322358d429b267548473eb
Linux Linux 6e65a09f927566f257322358d429b267548473eb
Linux Linux 6e65a09f927566f257322358d429b267548473eb
Linux Linux 6.10

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the Linux kernel's Bluetooth driver for Intel PCIe devices. It involves a buffer overflow risk where the function btintel_pcie_prepare_tx() copies data from a network packet into a fixed-size DMA buffer without checking if the packet is too large. The buffer size is 4096 bytes, but if a packet exceeds this, it could overflow and corrupt memory.

Detection Guidance

This vulnerability affects the Linux kernel's Bluetooth subsystem, specifically the btintel_pcie driver. Detection requires checking if your system uses this driver and if the kernel version is vulnerable. Inspect loaded kernel modules with 'lsmod | grep btintel_pcie' and check kernel version with 'uname -r'. If present, the vulnerability may be exploited if oversized packets are sent via btintel_pcie_send_sync().

Impact Analysis

If exploited, this flaw could allow an attacker to crash the system or potentially execute arbitrary code with kernel privileges. This might lead to denial-of-service conditions or unauthorized access to sensitive data on affected systems running the vulnerable Linux kernel.

Mitigation Strategies

Apply the latest kernel update from your Linux distribution to patch the btintel_pcie driver. If an update is unavailable, disable the btintel_pcie module with 'modprobe -r btintel_pcie' and prevent reloading by blacklisting it in '/etc/modprobe.d/blacklist.conf'.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98296. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart