CVE-2026-98731

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98731", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.367Z", "datePublished": "2026-10-18T15:47:08.399Z", "dateUpdated": "2026-10-19T09:24:41.766Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:24:41.766Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btintel_pcie: fix plen overflow in btintel_pcie_recv_frame()\n\nplen is u16 and computed as HDR_SIZE + dlen. For ACL/ISO frames dlen\nis a 16-bit field, so a value >= 0xFFFC wraps the sum, bypassing the\n\"skb->len < plen\" check and letting skb_trim() truncate the packet.\n\nWiden plen to u32 so the addition cannot wrap."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/bluetooth/btintel_pcie.c"], "versions": [{"version": "c2b636b3f788d10486a6691ad6dd3ec4c93bd78e", "lessThan": "c3a3842c109ac130c6db3aa0014cc8cd344928ad", "status": "affected", "versionType": "git"}, {"version": "c2b636b3f788d10486a6691ad6dd3ec4c93bd78e", "lessThan": "c3b5e6da4ba6485bffda9753d8339c28855207aa", "status": "affected", "versionType": "git"}, {"version": "c2b636b3f788d10486a6691ad6dd3ec4c93bd78e", "lessThan": "b2cb5ea1dc8cf829816370fc1399e6a1d2d1bca9", "status": "affected", "versionType": "git"}, {"version": "c2b636b3f788d10486a6691ad6dd3ec4c93bd78e", "lessThan": "7dbeb6935ac331b0cba6c41cabd8e9d02d5f64ea", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/bluetooth/btintel_pcie.c"], "versions": [{"version": "6.10", "status": "affected"}, {"version": "0", "lessThan": "6.10", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.113", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.56", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.10", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "6.12.113"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "6.18.56"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "7.2.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/c3a3842c109ac130c6db3aa0014cc8cd344928ad"}, {"url": "https://git.kernel.org/stable/c/c3b5e6da4ba6485bffda9753d8339c28855207aa"}, {"url": "https://git.kernel.org/stable/c/b2cb5ea1dc8cf829816370fc1399e6a1d2d1bca9"}, {"url": "https://git.kernel.org/stable/c/7dbeb6935ac331b0cba6c41cabd8e9d02d5f64ea"}], "title": "Bluetooth: btintel_pcie: fix plen overflow in btintel_pcie_recv_frame()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/bluetooth/btintel_pcie.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "c3a3842c109ac130c6db3aa0014cc8cd344928ad", "status": "affected", "version": "c2b636b3f788d10486a6691ad6dd3ec4c93bd78e", "versionType": "git"}, {"lessThan": "c3b5e6da4ba6485bffda9753d8339c28855207aa", "status": "affected", "version": "c2b636b3f788d10486a6691ad6dd3ec4c93bd78e", "versionType": "git"}, {"lessThan": "b2cb5ea1dc8cf829816370fc1399e6a1d2d1bca9", "status": "affected", "version": "c2b636b3f788d10486a6691ad6dd3ec4c93bd78e", "versionType": "git"}, {"lessThan": "7dbeb6935ac331b0cba6c41cabd8e9d02d5f64ea", "status": "affected", "version": "c2b636b3f788d10486a6691ad6dd3ec4c93bd78e", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/bluetooth/btintel_pcie.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.10"}, {"lessThan": "6.10", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.113", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.56", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btintel_pcie: fix plen overflow in btintel_pcie_recv_frame()\n\nplen is u16 and computed as HDR_SIZE + dlen. For ACL/ISO frames dlen\nis a 16-bit field, so a value >= 0xFFFC wraps the sum, bypassing the\n\"skb->len < plen\" check and letting skb_trim() truncate the packet.\n\nWiden plen to u32 so the addition cannot wrap."}], "id": "CVE-2026-98731", "lastModified": "2026-10-19T10:19:37.250", "metrics": {}, "published": "2026-10-18T16:17:26.710", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7dbeb6935ac331b0cba6c41cabd8e9d02d5f64ea"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b2cb5ea1dc8cf829816370fc1399e6a1d2d1bca9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c3a3842c109ac130c6db3aa0014cc8cd344928ad"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c3b5e6da4ba6485bffda9753d8339c28855207aa"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: Bluetooth: btintel_pcie: fix plen overflow in btintel_pcie_recv_frame()", "id": "2555123", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555123"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-190", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nBluetooth: btintel_pcie: fix plen overflow in btintel_pcie_recv_frame()\nplen is u16 and computed as HDR_SIZE + dlen. For ACL/ISO frames dlen\nis a 16-bit field, so a value >= 0xFFFC wraps the sum, bypassing the\n\"skb->len < plen\" check and letting skb_trim() truncate the packet.\nWiden plen to u32 so the addition cannot wrap.", "A flaw was found in the Linux kernel's Intel Bluetooth PCIe driver. An integer overflow vulnerability exists in the packet reception function when calculating the total length of incoming Bluetooth frames. An adjacent attacker within Bluetooth range could exploit this flaw by transmitting specially crafted frames with large data length values, bypassing buffer validation checks. This vulnerability can lead to improper packet truncation and cause a Denial of Service (DoS)."], "name": "CVE-2026-98731", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98731\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98731\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98731.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c2b636b3f788d10486a6691ad6dd3ec4c93bd78e,c3a3842c109ac130c6db3aa0014cc8cd344928ad)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c2b636b3f788d10486a6691ad6dd3ec4c93bd78e,c3b5e6da4ba6485bffda9753d8339c28855207aa)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c2b636b3f788d10486a6691ad6dd3ec4c93bd78e,b2cb5ea1dc8cf829816370fc1399e6a1d2d1bca9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c2b636b3f788d10486a6691ad6dd3ec4c93bd78e,7dbeb6935ac331b0cba6c41cabd8e9d02d5f64ea)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.10"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.10)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.113,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.56,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.10,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-18T22:15:14.437267+00:00", "updated": "2026-10-23T14:00:18.057448+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-190"]}