CVE-2026-98731
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel_pcie: fix plen overflow in btintel_pcie_recv_frame() plen is u16 and computed as HDR_SIZE + dlen. For ACL/ISO frames dlen is a 16-bit field, so a value >= 0xFFFC wraps the sum, bypassing the "skb->len < plen" check and letting skb_trim() truncate the packet. Widen plen to u32 so the addition cannot wrap.
- EPSS
- 0.2% chance of exploitation in the next 30 days; higher than 11% of CVEs (scores of 2026-10-25)
- Published
- Modified
- Record from
- the NVD, synced