CVE-2026-98730

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98730", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.366Z", "datePublished": "2026-10-18T15:47:07.600Z", "dateUpdated": "2026-10-19T09:24:40.788Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:24:40.788Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btintel_pcie: reject oversized TX packets in send_frame()\n\nbtintel_pcie_send_frame() eventually copies skb->data into a fixed\nBTINTEL_PCIE_BUFFER_SIZE (4096) DMA buffer via memcpy() in\nbtintel_pcie_prepare_tx(), with a 4-byte PCIe type header prepended.\nA user-space process with HCI_CHANNEL_USER access can inject an\noversized packet and overflow the buffer.\n\nReject packets larger than\nBTINTEL_PCIE_BUFFER_SIZE - BTINTEL_PCIE_HCI_TYPE_LEN on entry."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/bluetooth/btintel_pcie.c"], "versions": [{"version": "6e65a09f927566f257322358d429b267548473eb", "lessThan": "3d6ba6be9bef13edcd4ad74f7cfdd0c34db4d2bc", "status": "affected", "versionType": "git"}, {"version": "6e65a09f927566f257322358d429b267548473eb", "lessThan": "84df222de86eabed543361025ed54ce838c0b573", "status": "affected", "versionType": "git"}, {"version": "6e65a09f927566f257322358d429b267548473eb", "lessThan": "9806a748f9ab223b733624367b6ddda77fb9450e", "status": "affected", "versionType": "git"}, {"version": "6e65a09f927566f257322358d429b267548473eb", "lessThan": "f771f96557a4d953a7e4d045870547271e36e819", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/bluetooth/btintel_pcie.c"], "versions": [{"version": "6.10", "status": "affected"}, {"version": "0", "lessThan": "6.10", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.113", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.56", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.10", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "6.12.113"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "6.18.56"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "7.2.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/3d6ba6be9bef13edcd4ad74f7cfdd0c34db4d2bc"}, {"url": "https://git.kernel.org/stable/c/84df222de86eabed543361025ed54ce838c0b573"}, {"url": "https://git.kernel.org/stable/c/9806a748f9ab223b733624367b6ddda77fb9450e"}, {"url": "https://git.kernel.org/stable/c/f771f96557a4d953a7e4d045870547271e36e819"}], "title": "Bluetooth: btintel_pcie: reject oversized TX packets in send_frame()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/bluetooth/btintel_pcie.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "3d6ba6be9bef13edcd4ad74f7cfdd0c34db4d2bc", "status": "affected", "version": "6e65a09f927566f257322358d429b267548473eb", "versionType": "git"}, {"lessThan": "84df222de86eabed543361025ed54ce838c0b573", "status": "affected", "version": "6e65a09f927566f257322358d429b267548473eb", "versionType": "git"}, {"lessThan": "9806a748f9ab223b733624367b6ddda77fb9450e", "status": "affected", "version": "6e65a09f927566f257322358d429b267548473eb", "versionType": "git"}, {"lessThan": "f771f96557a4d953a7e4d045870547271e36e819", "status": "affected", "version": "6e65a09f927566f257322358d429b267548473eb", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/bluetooth/btintel_pcie.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.10"}, {"lessThan": "6.10", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.113", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.56", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btintel_pcie: reject oversized TX packets in send_frame()\n\nbtintel_pcie_send_frame() eventually copies skb->data into a fixed\nBTINTEL_PCIE_BUFFER_SIZE (4096) DMA buffer via memcpy() in\nbtintel_pcie_prepare_tx(), with a 4-byte PCIe type header prepended.\nA user-space process with HCI_CHANNEL_USER access can inject an\noversized packet and overflow the buffer.\n\nReject packets larger than\nBTINTEL_PCIE_BUFFER_SIZE - BTINTEL_PCIE_HCI_TYPE_LEN on entry."}], "id": "CVE-2026-98730", "lastModified": "2026-10-19T10:19:37.140", "metrics": {}, "published": "2026-10-18T16:17:26.623", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3d6ba6be9bef13edcd4ad74f7cfdd0c34db4d2bc"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/84df222de86eabed543361025ed54ce838c0b573"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9806a748f9ab223b733624367b6ddda77fb9450e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f771f96557a4d953a7e4d045870547271e36e819"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: Bluetooth: btintel_pcie: reject oversized TX packets in send_frame()", "id": "2555119", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555119"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.7", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-120", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nBluetooth: btintel_pcie: reject oversized TX packets in send_frame()\nbtintel_pcie_send_frame() eventually copies skb->data into a fixed\nBTINTEL_PCIE_BUFFER_SIZE (4096) DMA buffer via memcpy() in\nbtintel_pcie_prepare_tx(), with a 4-byte PCIe type header prepended.\nA user-space process with HCI_CHANNEL_USER access can inject an\noversized packet and overflow the buffer.\nReject packets larger than\nBTINTEL_PCIE_BUFFER_SIZE - BTINTEL_PCIE_HCI_TYPE_LEN on entry.", "A flaw was found in the Linux kernel's Intel Bluetooth PCIe driver. A local user with access to the Bluetooth Host Controller Interface (HCI) user channel can inject an oversized transmission packet. Because the driver fails to validate packet length before copying data into a fixed-size memory buffer, this issue causes a buffer overflow. This flaw can lead to arbitrary code execution or a system crash resulting in a Denial of Service (DoS)."], "name": "CVE-2026-98730", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98730\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98730\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98730.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[6e65a09f927566f257322358d429b267548473eb,3d6ba6be9bef13edcd4ad74f7cfdd0c34db4d2bc)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[6e65a09f927566f257322358d429b267548473eb,84df222de86eabed543361025ed54ce838c0b573)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[6e65a09f927566f257322358d429b267548473eb,9806a748f9ab223b733624367b6ddda77fb9450e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[6e65a09f927566f257322358d429b267548473eb,f771f96557a4d953a7e4d045870547271e36e819)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.10"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.10)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.113,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.56,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.10,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-18T19:15:14.231751+00:00", "updated": "2026-10-23T20:00:16.411382+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}