Cloudanix VulnDB

CVE-2026-98730

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in Linux kernel Bluetooth handling for certain Intel hardware lets a local user send too much data at once and potentially take over or crash the whole computer.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Privilege Gain
Component
OS kernel
Class
Buffer Overflow
Remediation
Patch
Effort
Low
Patch risk
Low

What it actually does

Buffer overflow in btintel_pcie driver when btintel_pcie_send_frame copies oversized skb data plus 4-byte header into a fixed 4096-byte DMA buffer via memcpy without prior size validation.

Why it matters to the business

Local attackers on affected Linux systems can crash the kernel or potentially execute arbitrary code through Bluetooth hardware access, leading to denial of service or full system compromise on devices using Intel PCIe Bluetooth controllers.

How an attack unfolds

An attacker with local user-space access obtains HCI_CHANNEL_USER privileges, crafts an oversized HCI packet exceeding the DMA buffer limit, and submits it via the Bluetooth stack, triggering the unchecked memcpy that overflows the buffer.

How to fix it

Update the Linux kernel to a version containing the btintel_pcie_send_frame size check rejecting packets larger than BTINTEL_PCIE_BUFFER_SIZE minus the 4-byte header length; rebuild and reboot affected systems.

How to confirm the fix worked

Confirm the patch is present by inspecting btintel_pcie.c for the early size rejection before prepare_tx, or verify the running kernel version includes the fix commit; test by attempting to send an oversized packet and confirming rejection.

Typical attack path

  1. Obtain local shell or process with HCI_CHANNEL_USER socket access
  2. Craft malicious oversized TX packet
  3. Inject packet into btintel_pcie_send_frame path
  4. Trigger memcpy overflow in btintel_pcie_prepare_tx
  5. Achieve kernel memory corruption or crash

How to detect it

Review kernel logs for btintel_pcie buffer overflow warnings or oops traces, audit socket creation attempts for HCI_CHANNEL_USER by untrusted processes, and inspect Bluetooth stack traffic for abnormally large TX frames.

  • btintel_pcie_send_frame
  • btintel_pcie_prepare_tx
  • BTINTEL_PCIE_BUFFER_SIZE
  • HCI_CHANNEL_USER oversized packet
  • memcpy overflow in btintel_pcie

What your security team should do

  • Apply kernel updates containing the size validation fix immediately on all systems with Intel PCIe Bluetooth
  • Restrict untrusted local access to HCI_CHANNEL_USER sockets via AppArmor or SELinux policies
  • Monitor for kernel oops or panic logs related to btintel_pcie
  • Audit Bluetooth user-space applications for unnecessary privileged HCI access

The record

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel_pcie: reject oversized TX packets in send_frame() btintel_pcie_send_frame() eventually copies skb->data into a fixed BTINTEL_PCIE_BUFFER_SIZE (4096) DMA buffer via memcpy() in btintel_pcie_prepare_tx(), with a 4-byte PCIe type header prepended. A user-space process with HCI_CHANNEL_USER access can inject an oversized packet and overflow the buffer. Reject packets larger than BTINTEL_PCIE_BUFFER_SIZE - BTINTEL_PCIE_HCI_TYPE_LEN on entry.

Affected packages

Ecosystem Package Introduced Fixed