Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel_pcie: fix plen overflow in btintel_pcie_recv_frame() plen is u16 and computed as HDR_SIZE + dlen. For ACL/ISO frames dlen is a 16-bit field, so a value >= 0xFFFC wraps the sum, bypassing the "skb->len < plen" check and letting skb_trim() truncate the packet. Widen plen to u32 so the addition cannot wrap.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
c2b636b3f788d10486a6691ad6dd3ec4c93bd78e to < c3a3842c109ac130c6db3aa0014cc8cd344928adaffectedc2b636b3f788d10486a6691ad6dd3ec4c93bd78e to < c3b5e6da4ba6485bffda9753d8339c28855207aaaffectedc2b636b3f788d10486a6691ad6dd3ec4c93bd78e to < b2cb5ea1dc8cf829816370fc1399e6a1d2d1bca9affectedc2b636b3f788d10486a6691ad6dd3ec4c93bd78e to < 7dbeb6935ac331b0cba6c41cabd8e9d02d5f64eaaffected
Linux Linux
Default version status: affected
6.10affected0 to < 6.10unaffected6.12.113 to ≤ 6.12.*unaffected6.18.56 to ≤ 6.18.*unaffected7.2.10 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected