CVE-2026-98730
Received Received - Intake

Bluetooth Stack Buffer Overflow in Linux Kernel

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel_pcie: reject oversized TX packets in send_frame() btintel_pcie_send_frame() eventually copies skb->data into a fixed BTINTEL_PCIE_BUFFER_SIZE (4096) DMA buffer via memcpy() in btintel_pcie_prepare_tx(), with a 4-byte PCIe type header prepended. A user-space process with HCI_CHANNEL_USER access can inject an oversized packet and overflow the buffer. Reject packets larger than BTINTEL_PCIE_BUFFER_SIZE - BTINTEL_PCIE_HCI_TYPE_LEN on entry.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98730
EUVD
EUVD-2026-103815

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
Linux Linux 6e65a09f927566f257322358d429b267548473eb
Linux Linux 6e65a09f927566f257322358d429b267548473eb
Linux Linux 6e65a09f927566f257322358d429b267548473eb
Linux Linux 6e65a09f927566f257322358d429b267548473eb
Linux Linux 6.10

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a buffer overflow vulnerability in the Linux kernel's Bluetooth driver for Intel PCIe devices. A user-space process with HCI_CHANNEL_USER access can send oversized Bluetooth packets that exceed the fixed 4096-byte DMA buffer, causing a memory overflow when the kernel copies the packet data.

Detection Guidance

This vulnerability involves oversized Bluetooth packets being processed by the Linux kernel's btintel_pcie driver. Detection requires checking for kernel logs or system crashes related to Bluetooth operations. Monitor dmesg or journalctl for errors like buffer overflow warnings or segmentation faults in btintel_pcie modules.

Impact Analysis

An attacker with local access could exploit this to crash the system, execute arbitrary code with kernel privileges, or cause denial-of-service conditions. Remote exploitation is unlikely as it requires HCI_CHANNEL_USER access.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for CVE-2026-98730. Disable Bluetooth functionality if not required, or restrict access to HCI_CHANNEL_USER to prevent malicious packet injection. Monitor vendor advisories for kernel updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98730. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart