{"id":"CVE-2026-98730","kind":"vulnerability","aliases":["CVE-2026-98730"],"related":[],"title":"Linux kernel: oversized Bluetooth packets overflow an Intel PCIe DMA buffer","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btintel_pcie: reject oversized TX packets in send_frame()\n\nbtintel_pcie_send_frame() eventually copies skb->data into a fixed\nBTINTEL_PCIE_BUFFER_SIZE (4096) DMA buffer via memcpy() in\nbtintel_pcie_prepare_tx(), with a 4-byte PCIe type header prepended.\nA user-space process with HCI_CHANNEL_USER access can inject an\noversized packet and overflow the buffer.\n\nReject packets larger than\nBTINTEL_PCIE_BUFFER_SIZE - BTINTEL_PCIE_HCI_TYPE_LEN on entry.","summary":"The Intel PCIe Bluetooth driver copies outgoing packets into a fixed 4096-byte DMA buffer without checking their length, so an oversized packet overflows it. A local user-space process with HCI user-channel access can trigger the overflow, which can corrupt kernel memory.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bluetooth","intel","kernel","laptops","linux","runtime"],"not_affected_if":["driver-not-loaded","no-intel-pcie-bluetooth"],"how_to_check":"- Run `uname -r` and compare against the kernel build that contains the btintel_pcie fix; the sources do not list fixed versions, so unknown\n- Check whether the `btintel_pcie` module is loaded with `lsmod | grep btintel_pcie`","fix":"- Update the Linux kernel to a release that includes the upstream fix rejecting packets larger than BTINTEL_PCIE_BUFFER_SIZE minus BTINTEL_PCIE_HCI_TYPE_LEN; the exact version is unknown from the sources","status":"open","published_at":"2026-10-18T16:17:26+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:17:15+00:00","updated_at":"2026-10-25T05:17:15+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T05:17:15Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream fix rejecting packets larger than BTINTEL_PCIE_BUFFER_SIZE minus BTINTEL_PCIE_HCI_TYPE_LEN; the exact version is unknown from the sources","reach":"local","title":"Linux kernel: oversized Bluetooth packets overflow an Intel PCIe DMA buffer","impact":"high","summary":"The Intel PCIe Bluetooth driver copies outgoing packets into a fixed 4096-byte DMA buffer without checking their length, so an oversized packet overflows it. A local user-space process with HCI user-channel access can trigger the overflow, which can corrupt kernel memory.","category":"runtime","nicknames":[],"who_cares":["linux","kernel","bluetooth","intel","laptops"],"confidence":0.6,"needs_auth":"yes","worst_case":"local process corrupts kernel memory via DMA buffer overflow","analyst_note":"Find the upstream kernel commit and the first fixed stable kernel versions for CVE-2026-98730 to fill in the fix and how_to_check fields.","how_to_check":"- Run `uname -r` and compare against the kernel build that contains the btintel_pcie fix; the sources do not list fixed versions, so unknown\n- Check whether the `btintel_pcie` module is loaded with `lsmod | grep btintel_pcie`","needs_analyst":true,"not_affected_if":["no-intel-pcie-bluetooth","driver-not-loaded"],"who_is_affected":"Only systems with an Intel PCIe Bluetooth controller using the btintel_pcie driver are exposed, and the attacker needs access to the HCI user channel, which normally requires local privileges. Machines without this Intel PCIe Bluetooth hardware or without the driver loaded can skip it. Servers without Bluetooth hardware are unlikely to be affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000699,"input_tokens":3473,"output_tokens":703,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-98730':14A,17A '4':117C '4096':35B,105C 'access':60B,132C 'bluetooth':4A,18B,27B,80C 'btintel':81C,90C,101C,111C,146C,150C 'buffer':11A,38B,103C,107C,141C,148C 'byte':36B,118C 'channel':59B,130C 'check':40B 'copi':29B,95C 'corrupt':67B 'cve':12A,15A 'data':97C 'dma':10A,37B,106C 'driver':28B 'entri':156C 'eventu':94C 'fix':34B,100C 'follow':75C 'frame':89C,93C 'hci':56B,129C,152C 'header':121C 'inject':134C 'intel':8A,19B,25B 'kernel':2A,20B,68B,73C 'laptop':21B 'larger':144C 'len':154C 'length':42B 'linux':1A,22B,72C 'local':50B 'memcpi':109C 'memori':69B 'outgo':30B 'overflow':6A,47B,64B,139C 'overs':3A,45B,84C,136C 'packet':5A,31B,46B,86C,137C,143C 'pcie':9A,26B,82C,91C,102C,112C,119C,147C,151C 'prepar':113C 'prepend':122C 'process':54B,127C 'reject':83C,142C 'resolv':79C 'runtim':23B 'send':88C,92C 'size':104C,149C 'skb':96C 'space':53B,126C 'trigger':62B 'tx':85C,114C 'type':120C,153C 'user':52B,58B,125C,131C 'user-channel':57B 'user-spac':51B,124C 'via':108C 'vulner':76C 'without':39B","nicknames":[],"mitigations":[],"who_affected":"Only systems with an Intel PCIe Bluetooth controller using the btintel_pcie driver are exposed, and the attacker needs access to the HCI user channel, which normally requires local privileges. Machines without this Intel PCIe Bluetooth hardware or without the driver loaded can skip it. Servers without Bluetooth hardware are unlikely to be affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:26+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98730","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98730","severity":null,"published_at":"2026-10-18T16:17:26+00:00","modified_at":"2026-10-19T10:19:37+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}