CVE-2026-98296

A flaw was found in the Linux kernel's Intel PCIe Bluetooth driver. The driver fails to validate the size of outgoing transmission packets before copying them into a fixed Direct Memory Access (DMA) buffer. A local attacker could exploit this issue by submitting oversized packets, triggering a buffer overflow that may result in memory corruption or a Denial of Service (DoS) through a system crash.

btintel_pcie_send_sync did not validate skb length before the transmit path copied skb data into a fixed 4096 byte DMA slot. If an oversized skb can reach this function, the unchecked copy can write beyond the DMA buffer and may cause kernel memory corruption, a crash, or potentially privilege escalation. The currently described external transmit path already rejects oversized packets, and the commit presents this check as protection against a future caller. Therefore a reliable trigger from an unprivileged user is not established by the supplied code. For the CVSS the PR:L value in the paranoid score assumes that a locally running user with limited Bluetooth access can reach an overlooked synchronous transmit path without full administrative control. The issue is not shown to be remotely triggerable over a network or directly through a Bluetooth radio peer.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.