CVE-2026-98731 in Linux
Summary
by MITRE • 10/18/2026
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: btintel_pcie: fix plen overflow in btintel_pcie_recv_frame()
plen is u16 and computed as HDR_SIZE + dlen. For ACL/ISO frames dlen is a 16-bit field, so a value >= 0xFFFC wraps the sum, bypassing the "skb->len < plen" check and letting skb_trim() truncate the packet.
Widen plen to u32 so the addition cannot wrap.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/18/2026
The Linux kernel Bluetooth subsystem contains an integer overflow vulnerability within the Intel PCIe driver component, specifically in the btintel_pcie_recv_frame function. This flaw arises from a type mismatch during arithmetic operations involving frame length calculations. The variable plen is defined as a 16-bit unsigned integer (u16), yet it is computed by adding HDR_SIZE to dlen. For ACL and ISO frames, the data length field dlen is also a 16-bit value. When the sum of these two values exceeds the maximum limit for a u16 type, which is 0xFFFF, an arithmetic overflow occurs. This results in the calculated plen wrapping around to a small positive number rather than reflecting the true total size of the incoming packet header and data payload.
This integer wraparound has significant security implications because it bypasses critical boundary checks implemented within the driver logic. The kernel code includes a validation step that compares the length of the socket buffer skb->len against the computed plen to ensure the received frame does not exceed expected bounds. Due to the overflow, the wrapped-around value of plen becomes artificially small, often smaller than the actual size of the data in the socket buffer. Consequently, this check fails to detect oversized or malformed packets that should have been rejected at an earlier stage of processing. The vulnerability effectively allows maliciously crafted Bluetooth frames with large payload sizes to pass through initial validation filters without triggering appropriate error handling mechanisms.
The operational impact of this flaw centers on improper memory management and potential data corruption during packet truncation. Once the flawed length check is bypassed, the system proceeds to process the frame using skb_trim(), a function designed to reduce the size of a socket buffer by discarding trailing bytes. Because plen has wrapped around to an incorrect value, skb_trim() may truncate the packet at an unintended offset or behave unpredictably depending on how the kernel handles such edge cases in memory allocation and pointer arithmetic. While the immediate effect is described as truncation, improper handling of truncated buffers can lead to inconsistent state within the Bluetooth stack, potential denial of service conditions due to resource exhaustion or crashes, and potentially information disclosure if subsequent operations rely on assumptions about buffer integrity that are no longer valid after incorrect trimming occurs.
From a technical remediation perspective, the issue is resolved by widening the data type of plen from u16 to u32. This change ensures that the addition of HDR_SIZE and dlen cannot overflow within the range of standard integer types used for length calculations in modern kernel environments. By using a 32-bit unsigned integer, the sum can correctly represent much larger values without wrapping around, thereby preserving the integrity of the boundary checks against skb->len. This fix aligns with secure coding practices that mandate appropriate data type selection to prevent arithmetic overflows during size computations.
This vulnerability is categorized under CWE-190 Integer Overflow or Wraparound within the Common Weakness Enumeration framework. It represents a classic case where insufficient validation of numeric inputs leads to logic errors in security-critical code paths. In terms of attack vector classification, this falls under CWE-20 Improper Input Validation because the system fails to properly validate data received from external sources before processing it. The exploitation scenario typically involves an attacker sending specially crafted Bluetooth packets over a PCIe-connected Intel adapter interface designed to trigger the overflow condition and manipulate kernel memory handling routines through the skb_trim function.
Mitigation strategies for this vulnerability primarily involve applying the upstream Linux kernel patch that corrects the variable type definition in btintel_pcie_recv_frame(). System administrators should ensure their systems are updated with patched versions of the Bluetooth stack and Intel PCIe drivers where applicable. For environments unable to immediately apply patches, network segmentation restricting access to vulnerable interfaces or monitoring for anomalous packet sizes may provide limited defensive visibility, though complete mitigation requires addressing the root cause in the kernel source code itself through proper type promotion during arithmetic operations involving length fields.