CVE-2026-98731 — Bluetooth: btintel_pcie: fix plen overflow in btintel_pcie_recv_frame()
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel_pcie: fix plen overflow in btintel_pcie_recv_frame() plen is u16 and computed as HDR_SIZ…
Published: 2026-10-18 · CVSS: Unscored
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel_pcie: fix plen overflow in btintel_pcie_recv_frame() plen is u16 and computed as HDR_SIZE + dlen. For ACL/ISO frames dlen is a 16-bit field, so a value >= 0xFFFC wraps the sum, bypassing the "skb->len < plen" check and letting skb_trim() truncate the packet. Widen plen to u32 so the addition cannot wrap.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7