{"id":"CVE-2026-98731","published":"2026-10-18T16:17:26.710","lastModified":"2026-10-19T10:19:37.250","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btintel_pcie: fix plen overflow in btintel_pcie_recv_frame()\n\nplen is u16 and computed as HDR_SIZE + dlen. For ACL/ISO frames dlen\nis a 16-bit field, so a value >= 0xFFFC wraps the sum, bypassing the\n\"skb->len < plen\" check and letting skb_trim() truncate the packet.\n\nWiden plen to u32 so the addition cannot wrap.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":[],"vendors":[],"products":[],"references":[{"url":"https://git.kernel.org/stable/c/7dbeb6935ac331b0cba6c41cabd8e9d02d5f64ea","tags":[]},{"url":"https://git.kernel.org/stable/c/b2cb5ea1dc8cf829816370fc1399e6a1d2d1bca9","tags":[]},{"url":"https://git.kernel.org/stable/c/c3a3842c109ac130c6db3aa0014cc8cd344928ad","tags":[]},{"url":"https://git.kernel.org/stable/c/c3b5e6da4ba6485bffda9753d8339c28855207aa","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}