In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel_pcie: fix plen overflow in btintel_pcie_recv_frame() plen is… (CVE-2026-98731)

The Linux kernel Bluetooth component btintel_pcie had a vulnerability where the plen variable, a 16-bit unsigned integer computed as HDR_SIZE plus dlen, could overflow if dlen was a large 16-bit value (>= 0xFFFC). This overflow caused the sum to wrap around, bypassing the skb->len < plen check and allowing skb_trim() to truncate the packet improperly. The fix involved changing plen to a 32-bit unsigned integer to prevent this overflow and ensure proper packet length validation.

This vulnerability could allow malformed Bluetooth packets to bypass length checks, potentially leading to improper packet truncation. The exact impact is not detailed in the provided data, but such issues can lead to memory corruption or denial of service in the Bluetooth subsystem.

A fix has been implemented in the Linux kernel by widening the plen variable to 32 bits to prevent overflow. Users should apply the official Linux kernel update that includes this fix. No additional mitigation steps are indicated.