In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel_pcie: reject oversized TX packets in send_frame()… (CVE-2026-98730)
Description
A vulnerability in the Linux kernel's Bluetooth component (btintel_pcie) was resolved by rejecting oversized transmit packets in the send_frame() function. The flaw allowed a user-space process with HCI_CHANNEL_USER access to inject packets larger than the fixed DMA buffer size, potentially causing a buffer overflow. The fix involves rejecting packets exceeding the buffer size minus the PCIe header length.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel's Bluetooth driver btintel_pcie had a vulnerability in the send_frame() function where skb->data was copied into a fixed-size DMA buffer (4096 bytes) via memcpy() without proper size checks. A user-space process with HCI_CHANNEL_USER access could send oversized packets that overflow this buffer. The vulnerability was addressed by rejecting packets larger than BTINTEL_PCIE_BUFFER_SIZE minus the PCIe header length on entry to prevent buffer overflow.
Potential Impact
This vulnerability could allow a local user-space process with HCI_CHANNEL_USER access to cause a buffer overflow in the Bluetooth driver, potentially leading to memory corruption. The exact impact is not detailed, but buffer overflows can lead to crashes or code execution in kernel context.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to reject oversized packets in the btintel_pcie send_frame() function, preventing buffer overflow. Users should update to the patched kernel version containing this fix. No additional mitigations are specified.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-3249-w698-6rq3
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-98730"]
Threat ID: 6ad520ab2cdf04f656993a07
Added to database: 10/18/2026, 19:40:27 UTC
Last enriched: 10/18/2026, 22:25:36 UTC
Last updated: 10/19/2026, 02:28:12 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.