CVE-2026-97976
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel_pcie: validate packet_len before skb_put_data btintel_pcie_submit_rx_work() reads packet_len from rfh_hdr without checking if it exceeds the RX buffer size. An oversized packet_len can lead to an out-of-bounds read in skb_put_data(). Validate packet_len to ensure it is non-zero and does not exceed BTINTEL_PCIE_BUFFER_SIZE - sizeof(*rfh_hdr), logging an error when invalid. This issue was reported by Claude Mythos. It can be simulated either by using customized firmware configured to return an invalid packet_len or by modifying rfh_hdr->packet_len in the driver before calling btintel_pcie_submit_rx_work().
Affected versions
Linux kernel versions
6.10
and later are affected. Fixed in
6.12.111,
6.18.53,
7.2.7,
7.3-rc3
and their respective stable series.
References
4 totalFrequently asked questions
-
What is CVE-2026-97976?
CVE-2026-97976 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 6.10 onward and has been patched in 6.12.111, 6.18.53, 7.2.7 and others. CVE-2026-97976 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-97976?
Yes. CVE-2026-97976 has been patched. Fixed versions include 6.12.111, 6.18.53, 7.2.7 and others. If you are running Linux kernel 6.10 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-97976 actively exploited?
No. CVE-2026-97976 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.