CVE-2026-97976
Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel_pcie: validate packet_len before skb_put_data btintel_pcie_submit_rx_work() reads packet_len from rfh_hdr without checking if it exceeds the RX buffer size. An oversized packet_len can lead to an out-of-bounds read in skb_put_data(). Validate packet_len to ensure it is non-zero and does not exceed BTINTEL_PCIE_BUFFER_SIZE - sizeof(*rfh_hdr), logging an error when invalid. This issue was reported by Claude Mythos. It can be simulated either by using customized firmware configured to return an invalid packet_len or by modifying rfh_hdr->packet_len in the driver before calling btintel_pcie_submit_rx_work().
How to fix
- Linux Linuxab0159b1f7214ce9bad9862751e4553e635a21b1, 73a50c636425cb9f7ab647b5a97bd14dd5610076, 46884c0f92708f1d218fc94d88800227a19b52f8, 6436e1b5331b1aebf905c13e0880a37032719b75 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | c2b636b3f788d10486a6691ad6dd3ec4c93bd78e ≤ v < ab0159b1f7214ce9bad9862751e4553e635a21b1, c2b636b3f788d10486a6691ad6dd3ec4c93bd78e ≤ v < 73a50c636425cb9f7ab647b5a97bd14dd5610076, c2b636b3f788d10486a6691ad6dd3ec4c93bd78e ≤ v < 46884c0f92708f1d218fc94d88800227a19b52f8, c2b636b3f788d10486a6691ad6dd3ec4c93bd78e ≤ v < 6436e1b5331b1aebf905c13e0880a37032719b75, 6.10 | ab0159b1f7214ce9bad9862751e4553e635a21b1, 73a50c636425cb9f7ab647b5a97bd14dd5610076, 46884c0f92708f1d218fc94d88800227a19b52f8, 6436e1b5331b1aebf905c13e0880a37032719b75 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.