{"id":"CVE-2026-98730","title":"kernel: Bluetooth: btintel_pcie: reject oversized TX packets in send_frame() (CVE-2026-98730)","summary":"A flaw was found in the Linux kernel's Intel Bluetooth PCIe driver. A local user with access to the Bluetooth Host Controller Interface (HCI) user channel can inject an oversized transmission packet. Because the driver fails to validate pa…","severity":"medium","cvss":6.7,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvssSource":"vendor","cwe":"CWE-120","vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","affected":["enterprise_linux 10","enterprise_linux 9","openshift_container_platform 4"],"published":"2026-10-18","updated":"2026-10-23","sourceUpdated":"2026-10-23T00:35:31+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98730.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98730.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-98730"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2555119"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-98730"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98730"},{"url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98730.mbox"},{"url":"https://git.kernel.org/stable/c/3d6ba6be9bef13edcd4ad74f7cfdd0c34db4d2bc"},{"url":"https://git.kernel.org/stable/c/84df222de86eabed543361025ed54ce838c0b573"},{"url":"https://git.kernel.org/stable/c/9806a748f9ab223b733624367b6ddda77fb9450e"},{"url":"https://git.kernel.org/stable/c/f771f96557a4d953a7e4d045870547271e36e819"}],"tags":["csaf","vex","red-hat","cve.org"],"epss":0.00168,"epssPercentile":0.06056,"ingestedAt":"2026-10-18T16:47:32.506Z","slug":"CVE-2026-98730","body":"## Overview\n\nA flaw was found in the Linux kernel's Intel Bluetooth PCIe driver. A local user with access to the Bluetooth Host Controller Interface (HCI) user channel can inject an oversized transmission packet. Because the driver fails to validate packet length before copying data into a fixed-size memory buffer, this issue causes a buffer overflow. This flaw can lead to arbitrary code execution or a system crash resulting in a Denial of Service (DoS).\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98730.json)\n\n**kernel: Bluetooth: btintel_pcie: reject oversized TX packets in send_frame()** — rated Moderate by Red Hat. Released 2026-10-18, updated 2026-10-23.\n\nAffected:\n\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 9\n- Red Hat OpenShift Container Platform 4\n\nNo fix planned:\n\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 9\n- Red Hat OpenShift Container Platform 4\n\nNot affected:\n\n- Red Hat Enterprise Linux 6\n- Red Hat Enterprise Linux 7\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n- Red Hat OpenShift Container Platform 4\n\n## Remediation\n\nFix deferred","depth":"sunlit","depthScore":37,"depthScoreParts":{"impact":36.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":228248,"id":"CVE-2026-98730","ts":1792758231726,"field":"cvss","old":null,"new":"6.7"},{"seq":228247,"id":"CVE-2026-98730","ts":1792758231726,"field":"severity","old":"none","new":"medium"}]}