CVE-2026-98731

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btintel pcie: fix plen overflow in btintel pcie recv frame()

plen is u16 and computed as HDR SIZE + dlen. For ACL/ISO frames dlen is a 16-bit field, so a value >= 0xFFFC wraps the sum, bypassing the "skb->len < plen" check and letting skb trim() truncate the packet.

Widen plen to u32 so the addition cannot wrap.