Live › vulnerability › CVE-2026-98731
Go to dashboardIn the Linux kernel's Bluetooth Intel PCIe driver, a 16-bit length sum can wrap for large ACL or ISO frames, which skips a length check and lets the packet be truncated. The sources describe the bug and its fix (widening the length variable to 32 bits) but do not state a demonstrated impact beyond that.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running a Linux kernel with the Intel PCIe Bluetooth driver (btintel_pcie) loaded, typically laptops and desktops with Intel Bluetooth over PCIe. Machines without this hardware or without the module loaded are not affected, and servers without Bluetooth hardware can usually skip it.
No product ranges from the sources yet.
uname -r and compare against the fixed kernel versions listed in the NVD entrybtintel_pcie module is loaded with lsmod | grep btintel_pciebtintel_pcie_recv_frame() function for a 32-bit plenEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: btintel_pcie: fix plen overflow in btintel_pcie_recv_frame()
plen is u16 and computed as HDR_SIZE + dlen. For ACL/ISO frames dlen is a 16-bit field, so a value >= 0xFFFC wraps the sum, bypassing the "skb->len < plen" check and letting skb_trim() truncate the packet.
Widen plen to u32 so the addition cannot wrap.
This page as .md · .json · in your agent: get_signal("CVE-2026-98731")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.