CVE-2026-97976

A flaw was found in the Linux kernel's Intel Bluetooth PCIe driver. The driver fails to validate the packet length received from the hardware buffer before copying data. A compromised or malicious Bluetooth device providing an oversized packet length can trigger an out-of-bounds memory read, leading to a system crash, resulting in a Denial of Service (DoS), or potential information disclosure.

A moderate-severity out-of-bounds read flaw was found in the Linux kernel's Intel Bluetooth PCIe (btintel_pcie) driver. In btintel_pcie_submit_rx_work(), the packet_len value read from the receive frame header (rfh_hdr) is passed to skb_put_data() without first being validated against the RX buffer size. A compromised or malicious Intel Bluetooth controller supplying an oversized packet_len can cause the kernel to read beyond the transport buffer, resulting in a kernel fault and system crash (denial of service); limited information disclosure is conceivable if the out-of-bounds data becomes observable through subsequent HCI processing, but this is not confirmed. An ordinary remote Bluetooth peer cannot control this PCIe transport header, so triggering the flaw effectively requires malicious or compromised controller firmware or local control over the Bluetooth device or its firmware, which significantly limits practical exploitation. For this reason Red Hat rates this flaw Moderate with availability-only impact (CVSS 5.5), a lower severity than the upstream record's framing of potential information disclosure. The vulnerable btintel_pcie PCIe transport code is present only in Red Hat Enterprise Linux 9 (from the RHEL 9.6 stream onward) and Red Hat Enterprise Linux 10, in RHIVOS 2 and RHIVOS Core 2, and in OpenShift Container Platform versions built on affected RHEL CoreOS 9 kernels (OpenShift 4.19 onward); Red Hat Enterprise Linux 6, 7, and 8, the earlier RHEL 9 streams (9.2, 9.4), and OpenShift versions built on RHEL CoreOS 8 or unaffected kernels are not affected because the vulnerable code is not present in those products. For the affected products the fix has been deferred to a future update; the residual risk is limited to local denial of service, or at most limited disclosure of adjacent kernel memory, given the requirement for a malicious or compromised Bluetooth controller.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.