CVE-2026-98731
Received Received - Intake

Bluetooth PCIe Frame Length Overflow in Linux Kernel

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel_pcie: fix plen overflow in btintel_pcie_recv_frame() plen is u16 and computed as HDR_SIZE + dlen. For ACL/ISO frames dlen is a 16-bit field, so a value >= 0xFFFC wraps the sum, bypassing the "skb->len < plen" check and letting skb_trim() truncate the packet. Widen plen to u32 so the addition cannot wrap.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98731
EUVD
EUVD-2026-103816

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
Linux Linux c2b636b3f788d10486a6691ad6dd3ec4c93bd78e
Linux Linux c2b636b3f788d10486a6691ad6dd3ec4c93bd78e
Linux Linux c2b636b3f788d10486a6691ad6dd3ec4c93bd78e
Linux Linux c2b636b3f788d10486a6691ad6dd3ec4c93bd78e
Linux Linux 6.10

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Bluetooth vulnerability in the Linux kernel where a buffer length calculation can overflow. The issue occurs in btintel_pcie_recv_frame() where plen is computed as HDR_SIZE + dlen. For certain frame types, dlen is a 16-bit value that can be very large, causing plen to wrap around due to integer overflow. This bypasses a length check and allows packet truncation via skb_trim().

Detection Guidance

This vulnerability affects the Linux kernel's Bluetooth subsystem, specifically the btintel_pcie driver. Detection requires checking kernel logs for related errors or examining the driver code for the described issue. No direct commands are provided in the context to detect this vulnerability.

Impact Analysis

An attacker within Bluetooth range could exploit this to cause denial of service by crashing the system or corrupting network operations. It may also allow unauthorized data manipulation if combined with other vulnerabilities.

Mitigation Strategies

Apply the Linux kernel patch that resolves this issue by widening the 'plen' variable to u32 to prevent overflow. Update to a patched kernel version where this fix is included. Monitor vendor advisories for kernel updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98731. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart