CVE-2026-98730
- Source
- https://cve.org/CVERecord?id=CVE-2026-98730
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-98730.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-98730
- Downstream
- Published
- 2026-10-18T15:47:07Z
- Modified
- 2026-10-19T02:46:05Z
- Summary
- Bluetooth: btintel_pcie: reject oversized TX packets in send_frame()
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: btintel_pcie: reject oversized TX packets in send_frame()
btintel_pcie_send_frame() eventually copies skb->data into a fixed BTINTEL_PCIE_BUFFER_SIZE (4096) DMA buffer via memcpy() in btintel_pcie_prepare_tx(), with a 4-byte PCIe type header prepended. A user-space process with HCI_CHANNEL_USER access can inject an oversized packet and overflow the buffer.
Reject packets larger than BTINTEL_PCIE_BUFFER_SIZE - BTINTEL_PCIE_HCI_TYPE_LEN on entry.
- Database specific
{ "cna_assigner": "Linux", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98730.json" }- References
-
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- https://git.kernel.org/stable/c/3d6ba6be9bef13edcd4ad74f7cfdd0c34db4d2bc
- https://git.kernel.org/stable/c/84df222de86eabed543361025ed54ce838c0b573
- https://git.kernel.org/stable/c/9806a748f9ab223b733624367b6ddda77fb9450e
- https://git.kernel.org/stable/c/f771f96557a4d953a7e4d045870547271e36e819
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98730.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-98730
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced6e65a09f927566f257322358d429b267548473ebFixed3d6ba6be9bef13edcd4ad74f7cfdd0c34db4d2bcFixed84df222de86eabed543361025ed54ce838c0b573Fixed9806a748f9ab223b733624367b6ddda77fb9450eFixedf771f96557a4d953a7e4d045870547271e36e819