CVE-2026-98296

What it actually does

Unchecked memcpy in btintel_pcie_prepare_tx copies an arbitrary skb length into a fixed 4096-byte DMA buffer when btintel_pcie_send_sync is called, allowing an out-of-bounds write.

Why it matters to the business

Linux systems using Intel PCIe Bluetooth hardware face risk of kernel memory corruption that can cause crashes, denial of service, or potential local privilege escalation.

How an attack unfolds

An attacker crafts an oversized Bluetooth skb and invokes the send_sync path (directly or via future callers) so the missing bounds check allows the memcpy to overflow the DMA slot.

How to fix it

Apply the upstream kernel patch that adds the skb length validation immediately before skb_push and the DMA copy inside btintel_pcie_send_sync; rebuild and deploy the fixed kernel image.

How to confirm the fix worked

Confirm the presence of the bounds-check patch in btintel_pcie_send_sync and verify that oversized skbs are rejected before the memcpy; test with synthetic large-packet Bluetooth traffic.

Typical attack path

1. Identify a Linux host with vulnerable btintel_pcie driver
2. Trigger Bluetooth stack activity that reaches btintel_pcie_send_sync with a large skb
3. Perform the out-of-bounds DMA write to corrupt adjacent kernel memory
4. Escalate to denial of service or code execution

How to detect it

Inspect kernel logs for btintel_pcie DMA buffer overruns, unexpected skb lengths exceeding 4096 bytes on the Bluetooth transmit path, and any oops or panic traces referencing btintel_pcie_send_sync.

What your security team should do

• Prioritize kernel update on all systems exposing the btintel_pcie driver
• Monitor for Bluetooth-related kernel oops or DMA errors in system logs
• Restrict untrusted local access until patches are applied