CVE-2026-98296
Unknown
Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel_pcie: validate TX skb length in send_sync btintel_pcie_prepare_tx() copies skb->len bytes into a fixed BTINTEL_PCIE_BUFFER_SIZE (4096) DMA slot via an unchecked memcpy. Oversized packets are currently rejected only in btintel_pcie_send_frame(); any future caller of btintel_pcie_send_sync() would silently overflow the DMA buffer. Add the bounds check in btintel_pcie_send_sync() itself, right before skb_push() and the DMA copy.
SeverityUnknown
CVSS—
Exploit probability—
Product
Linux
PublishedOct 6, 2026
First seenOct 6, 2026
How to fix
Update
- Linux Linux84f353256e170dc4865d45007d1bc446ed566da7, c298a61e18029401486c40298a50fbeea7e7b663, 4b837ebd0ea21ae5cc26f02dc042edc6fe7b46b9 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 6e65a09f927566f257322358d429b267548473eb ≤ v < 84f353256e170dc4865d45007d1bc446ed566da7, 6e65a09f927566f257322358d429b267548473eb ≤ v < c298a61e18029401486c40298a50fbeea7e7b663, 6e65a09f927566f257322358d429b267548473eb ≤ v < 4b837ebd0ea21ae5cc26f02dc042edc6fe7b46b9, 6.10 | 84f353256e170dc4865d45007d1bc446ed566da7, c298a61e18029401486c40298a50fbeea7e7b663, 4b837ebd0ea21ae5cc26f02dc042edc6fe7b46b9 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.