87 matches found
SUSE CVE-2026-98731
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: fix plen overflow in btintelpcierecvframe plen is u16 and computed as HDRSIZE + dlen. For ACL/ISO frames dlen is a 16-bit field, so a value = 0xFFFC wraps the sum, bypassing the "skb-len plen" check and...
Linux Distros Unpatched Vulnerability : CVE-2026-98731
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: btintelpcie: fix plen overflow in btintelpcierecvframe plen is u16 and computed as HDRSIZE + dlen. For ACL/ISO frames dlen is a 16-bit field, so a...
Linux Distros Unpatched Vulnerability : CVE-2026-98730
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: btintelpcie: reject oversized TX packets in sendframe btintelpciesendframe eventually copies skb-data into a fixed BTINTELPCIEBUFFERSIZE 4096 DMA...
Linux Distros Unpatched Vulnerability : CVE-2026-98601
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: btintelpcie: validate device-supplied DMA indices In btintelpciemsixrxhandle, the driver processes RX completion descriptors urbd1 written by the PCI...
CVE-2026-98601
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: validate device-supplied DMA indices In btintelpciemsixrxhandle, the driver processes RX completion descriptors urbd1 written by the PCIe device into DMA-coherent memory. urbd1-frbdtag a 16-bit field fully...
UBUNTU-CVE-2026-98731
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: fix plen overflow in btintelpcierecvframe plen is u16 and computed as HDRSIZE + dlen. For ACL/ISO frames dlen is a 16-bit field, so a value = 0xFFFC wraps the sum, bypassing the "skb-len plen" check and...
UBUNTU-CVE-2026-98601
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: validate device-supplied DMA indices In btintelpciemsixrxhandle, the driver processes RX completion descriptors urbd1 written by the PCIe device into DMA-coherent memory. urbd1-frbdtag a 16-bit field fully...
CVE-2026-98731
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: fix plen overflow in btintelpcierecvframe plen is u16 and computed as HDRSIZE + dlen. For ACL/ISO frames dlen is a 16-bit field, so a value = 0xFFFC wraps the sum, bypassing the "skb-len plen" check and...
CVE-2026-98730
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: reject oversized TX packets in sendframe btintelpciesendframe eventually copies skb-data into a fixed BTINTELPCIEBUFFERSIZE 4096 DMA buffer via memcpy in btintelpciepreparetx, with a 4-byte PCIe type heade...
UBUNTU-CVE-2026-98730
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: reject oversized TX packets in sendframe btintelpciesendframe eventually copies skb-data into a fixed BTINTELPCIEBUFFERSIZE 4096 DMA buffer via memcpy in btintelpciepreparetx, with a 4-byte PCIe type heade...
SUSE CVE-2026-98730
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: reject oversized TX packets in sendframe btintelpciesendframe eventually copies skb-data into a fixed BTINTELPCIEBUFFERSIZE 4096 DMA buffer via memcpy in btintelpciepreparetx, with a 4-byte PCIe type heade...
DEBIAN-CVE-2026-98601
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: validate device-supplied DMA indices In btintelpciemsixrxhandle, the driver processes RX completion descriptors urbd1 written by the PCIe device into DMA-coherent memory. urbd1-frbdtag a 16-bit field fully...
DEBIAN-CVE-2026-98730
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: reject oversized TX packets in sendframe btintelpciesendframe eventually copies skb-data into a fixed BTINTELPCIEBUFFERSIZE 4096 DMA buffer via memcpy in btintelpciepreparetx, with a 4-byte PCIe type heade...
DEBIAN-CVE-2026-98731
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: fix plen overflow in btintelpcierecvframe plen is u16 and computed as HDRSIZE + dlen. For ACL/ISO frames dlen is a 16-bit field, so a value = 0xFFFC wraps the sum, bypassing the "skb-len plen" check and...
CVE-2026-98730
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: reject oversized TX packets in sendframe btintelpciesendframe eventually copies skb-data into a fixed BTINTELPCIEBUFFERSIZE 4096 DMA buffer via memcpy in btintelpciepreparetx, with a 4-byte PCIe type heade...
CVE-2026-98731
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: fix plen overflow in btintelpcierecvframe plen is u16 and computed as HDRSIZE + dlen. For ACL/ISO frames dlen is a 16-bit field, so a value = 0xFFFC wraps the sum, bypassing the "skb-len plen" check and...
CVE-2026-98601
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: validate device-supplied DMA indices In btintelpciemsixrxhandle, the driver processes RX completion descriptors urbd1 written by the PCIe device into DMA-coherent memory. urbd1-frbdtag a 16-bit field fully...
CVE-2026-98731 Bluetooth: btintel_pcie: fix plen overflow in btintel_pcie_recv_frame()
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: fix plen overflow in btintelpcierecvframe plen is u16 and computed as HDRSIZE + dlen. For ACL/ISO frames dlen is a 16-bit field, so a value = 0xFFFC wraps the sum, bypassing the "skb-len plen" check and...
EUVD-2026-103816
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: fix plen overflow in btintelpcierecvframe plen is u16 and computed as HDRSIZE + dlen. For ACL/ISO frames dlen is a 16-bit field, so a value = 0xFFFC wraps the sum, bypassing the "skb-len plen" check and...
CVE-2026-98731
The Linux kernel contains a vulnerability in the Bluetooth btintel_pcie component within the btintel_pcie_recv_frame() function. The root cause is an integer overflow where the plen variable, defined as a u16, wraps when calculating HDR_SIZE + dlen for ACL/ISO frames if dlen is greater than or eq...