CVE-2026-98730

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btintel pcie: reject oversized TX packets in send frame()

btintel pcie send frame() eventually copies skb->data into a fixed BTINTEL PCIE BUFFER SIZE (4096) DMA buffer via memcpy() in btintel pcie prepare tx(), with a 4-byte PCIe type header prepended. A user-space process with HCI CHANNEL USER access can inject an oversized packet and overflow the buffer.

Reject packets larger than BTINTEL PCIE BUFFER SIZE - BTINTEL PCIE HCI TYPE LEN on entry.