In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btintel_pcie: fix plen overflow in btintel_pcie_recv_frame()

plen is u16 and computed as HDR_SIZE + dlen. For ACL/ISO frames dlen
is a 16-bit field, so a value >= 0xFFFC wraps the sum, bypassing the
"skb->len < plen" check and letting skb_trim() truncate the packet.

Widen plen to u32 so the addition cannot wrap.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
c2b636b3f788d10486a6691ad6dd3ec4c93bd78e affected < c3a3842c109ac130c6db3aa0014cc8cd344928ad
c2b636b3f788d10486a6691ad6dd3ec4c93bd78e affected < c3b5e6da4ba6485bffda9753d8339c28855207aa
c2b636b3f788d10486a6691ad6dd3ec4c93bd78e affected < b2cb5ea1dc8cf829816370fc1399e6a1d2d1bca9
c2b636b3f788d10486a6691ad6dd3ec4c93bd78e affected < 7dbeb6935ac331b0cba6c41cabd8e9d02d5f64ea
Linux Linux affected
Version Status Constraints
6.10 affected —
0 unaffected < 6.10
6.12.113 unaffected ≤ 6.12.*
6.18.56 unaffected ≤ 6.18.*
7.2.10 unaffected ≤ 7.2.*
7.3-rc6 unaffected ≤ *

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/7dbeb6935ac331b0cba6c41cabd8e9d02d5f64ea cve-icon cve-icon
https://git.kernel.org/stable/c/b2cb5ea1dc8cf829816370fc1399e6a1d2d1bca9 cve-icon cve-icon
https://git.kernel.org/stable/c/c3a3842c109ac130c6db3aa0014cc8cd344928ad cve-icon cve-icon
https://git.kernel.org/stable/c/c3b5e6da4ba6485bffda9753d8339c28855207aa cve-icon cve-icon
History

Sun, 18 Oct 2026 22:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-190

Sun, 18 Oct 2026 16:00:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel_pcie: fix plen overflow in btintel_pcie_recv_frame() plen is u16 and computed as HDR_SIZE + dlen. For ACL/ISO frames dlen is a 16-bit field, so a value >= 0xFFFC wraps the sum, bypassing the "skb->len < plen" check and letting skb_trim() truncate the packet. Widen plen to u32 so the addition cannot wrap.
Title Bluetooth: btintel_pcie: fix plen overflow in btintel_pcie_recv_frame()
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-10-18T15:47:08.399Z

Reserved: 2026-09-25T10:25:14.367Z

Link: CVE-2026-98731

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-18T16:17:26.710

Modified: 2026-10-18T16:17:26.710

Link: CVE-2026-98731

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-18T22:15:14Z

Weaknesses