{"id":"CVE-2026-98731","kind":"vulnerability","aliases":["CVE-2026-98731"],"related":[],"title":"Linux kernel: Bluetooth Intel PCIe frame length overflow mishandles packets","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btintel_pcie: fix plen overflow in btintel_pcie_recv_frame()\n\nplen is u16 and computed as HDR_SIZE + dlen. For ACL/ISO frames dlen\nis a 16-bit field, so a value >= 0xFFFC wraps the sum, bypassing the\n\"skb->len < plen\" check and letting skb_trim() truncate the packet.\n\nWiden plen to u32 so the addition cannot wrap.","summary":"In the Linux kernel's Bluetooth Intel PCIe driver, a 16-bit length sum can wrap for large ACL or ISO frames, which skips a length check and lets the packet be truncated. The sources describe the bug and its fix (widening the length variable to 32 bits) but do not state a demonstrated impact beyond that.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bluetooth","infrastructure","intel-pcie","laptops","linux-kernel"],"not_affected_if":["module-not-loaded","no-intel-pcie-bluetooth"],"how_to_check":"- Run `uname -r` and compare against the fixed kernel versions listed in the NVD entry\n- Check whether the `btintel_pcie` module is loaded with `lsmod | grep btintel_pcie`\n- Confirm the kernel source includes the fix by checking the `btintel_pcie_recv_frame()` function for a 32-bit `plen`","fix":"- Update the Linux kernel to a release that includes the upstream fix for CVE-2026-98731 (exact fixed versions: unknown)\n- Reboot into the patched kernel after your distribution ships it","status":"open","published_at":"2026-10-18T16:17:26+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:17:14+00:00","updated_at":"2026-10-25T05:17:14+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-25T05:17:14Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream fix for CVE-2026-98731 (exact fixed versions: unknown)\n- Reboot into the patched kernel after your distribution ships it","reach":"local","title":"Linux kernel: Bluetooth Intel PCIe frame length overflow mishandles packets","impact":"medium","summary":"In the Linux kernel's Bluetooth Intel PCIe driver, a 16-bit length sum can wrap for large ACL or ISO frames, which skips a length check and lets the packet be truncated. The sources describe the bug and its fix (widening the length variable to 32 bits) but do not state a demonstrated impact beyond that.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","bluetooth","intel-pcie","laptops"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unknown; packet truncation from a crafted Bluetooth frame","analyst_note":"Check the NVD entry and the upstream kernel commit for the affected and fixed version ranges and whether a remote Bluetooth attacker can trigger the overflow.","how_to_check":"- Run `uname -r` and compare against the fixed kernel versions listed in the NVD entry\n- Check whether the `btintel_pcie` module is loaded with `lsmod | grep btintel_pcie`\n- Confirm the kernel source includes the fix by checking the `btintel_pcie_recv_frame()` function for a 32-bit `plen`","needs_analyst":true,"not_affected_if":["no-intel-pcie-bluetooth","module-not-loaded"],"who_is_affected":"Systems running a Linux kernel with the Intel PCIe Bluetooth driver (btintel_pcie) loaded, typically laptops and desktops with Intel Bluetooth over PCIe. Machines without this hardware or without the module loaded are not affected, and servers without Bluetooth hardware can usually skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000702,"input_tokens":3397,"output_tokens":724,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-98731':13A,16A '0xfffc':124C '16':36B,118C '32':72B 'acl':44B 'acl/iso':113C 'addit':147C 'beyond':81B 'bit':37B,73B,119C 'bluetooth':3A,17B,31B,92C 'btintel':93C,99C 'bug':63B 'bypass':128C 'cannot':148C 'check':52B,133C 'comput':107C 'cve':11A,14A 'demonstr':79B 'describ':61B 'dlen':111C,115C 'driver':34B 'field':120C 'fix':66B,95C 'follow':87C 'frame':6A,47B,102C,114C 'hdr':109C 'impact':80B 'infrastructur':18B 'intel':4A,20B,32B 'intel-pci':19B 'iso':46B 'kernel':2A,25B,29B,85C 'laptop':22B 'larg':43B 'len':131C 'length':7A,38B,51B,69B 'let':54B,135C 'linux':1A,24B,28B,84C 'linux-kernel':23B 'mishandl':9A 'overflow':8A,97C 'packet':10A,56B,140C 'pcie':5A,21B,33B,94C,100C 'plen':96C,103C,132C,142C 'recv':101C 'resolv':91C 'size':110C 'skb':130C,136C 'skip':49B 'sourc':60B 'state':77B 'sum':39B,127C 'trim':137C 'truncat':58B,138C 'u16':105C 'u32':144C 'valu':123C 'variabl':70B 'vulner':88C 'widen':67B,141C 'wrap':41B,125C,149C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the Intel PCIe Bluetooth driver (btintel_pcie) loaded, typically laptops and desktops with Intel Bluetooth over PCIe. Machines without this hardware or without the module loaded are not affected, and servers without Bluetooth hardware can usually skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:26+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98731","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98731","severity":null,"published_at":"2026-10-18T16:17:26+00:00","modified_at":"2026-10-19T10:19:37+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}