CVE-2026-98730 in Linux
Summary
by MITRE • 10/18/2026
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: btintel_pcie: reject oversized TX packets in send_frame()
btintel_pcie_send_frame() eventually copies skb->data into a fixed BTINTEL_PCIE_BUFFER_SIZE (4096) DMA buffer via memcpy() in btintel_pcie_prepare_tx(), with a 4-byte PCIe type header prepended. A user-space process with HCI_CHANNEL_USER access can inject an oversized packet and overflow the buffer.
Reject packets larger than BTINTEL_PCIE_BUFFER_SIZE - BTINTEL_PCIE_HCI_TYPE_LEN on entry.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/19/2026
The Linux kernel Bluetooth subsystem contains a critical memory corruption vulnerability within the Intel PCIe driver, specifically in the btintel_pcie_send_frame function chain. This flaw arises from an insufficient boundary check when handling incoming data frames destined for transmission over the PCI Express interface. The core issue lies in how user-space processes interacting with the HCI channel are handled during frame preparation. When a packet is received via the HCI_CHANNEL_USER access point, it undergoes processing through btintel_pcie_prepare_tx before being transmitted. This function utilizes memcpy to copy data from the socket buffer into a fixed-size DMA buffer defined by BTINTEL_PCIE_BUFFER_SIZE, which has a capacity of 4096 bytes. Crucially, this operation prepends a four-byte PCIe type header to the payload prior to or during the memory copy process.
The technical flaw is characterized as an out-of-bounds write resulting from missing input validation on packet size. Because the destination buffer is fixed at 4096 bytes and requires space for a four-byte header, any incoming frame exceeding this effective limit will cause memcpy to overwrite adjacent memory locations beyond the allocated DMA buffer boundary. This condition allows a local user-space process with appropriate HCI permissions to trigger a heap-based or stack-based buffer overflow depending on the specific allocation context of the driver structures involved. The vulnerability effectively permits an attacker who can inject arbitrary data into the Bluetooth HCI interface to corrupt kernel memory, potentially leading to privilege escalation, denial of service through system crash, or remote code execution if adjacent memory controls such as function pointers are overwritten.
From a threat modeling perspective, this vulnerability aligns with CWE-120 Buffer Copy without Checking Size of Input Classic buffer overflow and CWE-787 Out-of-bounds Write. In the context of the MITRE ATT&CK framework for Linux systems, this flaw facilitates techniques associated with Privilege Escalation via Local Exploitation and potentially Defense Evasion if used to obscure malicious activity through system instability or memory corruption artifacts. The attack vector is local but requires specific access privileges to the HCI user channel, which may be available to unprivileged users depending on system configuration and device permissions.
The operational impact of this vulnerability includes severe stability risks for systems utilizing Intel Bluetooth adapters with PCIe interfaces. Successful exploitation can result in kernel panics or unpredictable behavior due to memory corruption affecting critical driver structures or neighboring objects in the slab allocator. Furthermore, because the affected code path is involved in active network transmission, an attacker could potentially craft malicious packets that exploit this overflow during high-throughput scenarios, increasing the likelihood of successful exploitation under normal system load conditions.
To mitigate this risk, immediate patching to include the validation check rejecting packets larger than BTINTEL_PCIE_BUFFER_SIZE minus BTINTEL_PCIE_HCI_TYPE_LEN is required upon entry into send_frame. System administrators should ensure that their Linux kernels are updated to versions containing this fix. Additionally, restricting HCI_CHANNEL_USER access through strict file permissions and monitoring for unusual Bluetooth traffic patterns can reduce the attack surface until patches are applied. Developers integrating similar drivers must enforce rigorous size validation before any memory copy operations involving fixed-size buffers to prevent analogous vulnerabilities in other subsystems.