Live › vulnerability › CVE-2026-98730
Go to dashboardThe Intel PCIe Bluetooth driver copies outgoing packets into a fixed 4096-byte DMA buffer without checking their length, so an oversized packet overflows it. A local user-space process with HCI user-channel access can trigger the overflow, which can corrupt kernel memory.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only systems with an Intel PCIe Bluetooth controller using the btintel_pcie driver are exposed, and the attacker needs access to the HCI user channel, which normally requires local privileges. Machines without this Intel PCIe Bluetooth hardware or without the driver loaded can skip it. Servers without Bluetooth hardware are unlikely to be affected.
No product ranges from the sources yet.
uname -r and compare against the kernel build that contains the btintel_pcie fix; the sources do not list fixed versions, so unknownbtintel_pcie module is loaded with lsmod | grep btintel_pcieEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: btintel_pcie: reject oversized TX packets in send_frame()
btintel_pcie_send_frame() eventually copies skb->data into a fixed BTINTEL_PCIE_BUFFER_SIZE (4096) DMA buffer via memcpy() in btintel_pcie_prepare_tx(), with a 4-byte PCIe type header prepended. A user-space process with HCI_CHANNEL_USER access can inject an oversized packet and overflow the buffer.
Reject packets larger than BTINTEL_PCIE_BUFFER_SIZE - BTINTEL_PCIE_HCI_TYPE_LEN on entry.
This page as .md · .json · in your agent: get_signal("CVE-2026-98730")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.