CVE-2026-98296

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btintel pcie: validate TX skb length in send sync

btintel pcie prepare tx() copies skb->len bytes into a fixed BTINTEL PCIE BUFFER SIZE (4096) DMA slot via an unchecked memcpy. Oversized packets are currently rejected only in btintel pcie send frame(); any future caller of btintel pcie send sync() would silently overflow the DMA buffer.

Add the bounds check in btintel pcie send sync() itself, right before skb push() and the DMA copy.