CVE-2026-97976

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btintel pcie: validate packet len before skb put data

btintel pcie submit rx work() reads packet len from rfh hdr without checking if it exceeds the RX buffer size. An oversized packet len can lead to an out-of-bounds read in skb put data().

Validate packet len to ensure it is non-zero and does not exceed BTINTEL PCIE BUFFER SIZE - sizeof(*rfh hdr), logging an error when invalid.

This issue was reported by Claude Mythos. It can be simulated either by using customized firmware configured to return an invalid packet len or by modifying rfh hdr->packet len in the driver before calling btintel pcie submit rx work().