CVE-2026-98730
Unknown
Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel_pcie: reject oversized TX packets in send_frame() btintel_pcie_send_frame() eventually copies skb->data into a fixed BTINTEL_PCIE_BUFFER_SIZE (4096) DMA buffer via memcpy() in btintel_pcie_prepare_tx(), with a 4-byte PCIe type header prepended. A user-space process with HCI_CHANNEL_USER access can inject an oversized packet and overflow the buffer. Reject packets larger than BTINTEL_PCIE_BUFFER_SIZE - BTINTEL_PCIE_HCI_TYPE_LEN on entry.
SeverityUnknown
CVSS—
Exploit probability—
Product
Linux
PublishedOct 18, 2026
First seenOct 18, 2026
How to fix
Update
- Linux Linux3d6ba6be9bef13edcd4ad74f7cfdd0c34db4d2bc, 84df222de86eabed543361025ed54ce838c0b573, 9806a748f9ab223b733624367b6ddda77fb9450e, f771f96557a4d953a7e4d045870547271e36e819 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 6e65a09f927566f257322358d429b267548473eb ≤ v < 3d6ba6be9bef13edcd4ad74f7cfdd0c34db4d2bc, 6e65a09f927566f257322358d429b267548473eb ≤ v < 84df222de86eabed543361025ed54ce838c0b573, 6e65a09f927566f257322358d429b267548473eb ≤ v < 9806a748f9ab223b733624367b6ddda77fb9450e, 6e65a09f927566f257322358d429b267548473eb ≤ v < f771f96557a4d953a7e4d045870547271e36e819, 6.10 | 3d6ba6be9bef13edcd4ad74f7cfdd0c34db4d2bc, 84df222de86eabed543361025ed54ce838c0b573, 9806a748f9ab223b733624367b6ddda77fb9450e, f771f96557a4d953a7e4d045870547271e36e819 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.