Live › vulnerability › CVE-2026-98601
Go to dashboardThe Linux kernel's Intel PCIe Bluetooth driver uses index values written by the device into shared DMA memory without bounds checks, so an out-of-range value can index past a buffer array. A malicious or faulty Bluetooth device can cause an out-of-bounds access or a hang in the kernel driver.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running a Linux kernel with the btintel_pcie driver, which handles Intel Bluetooth controllers attached over PCIe. The sources do not say which kernel versions are affected or whether a default build loads this driver, so the exposure of a given machine is unknown.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: btintel_pcie: validate device-supplied DMA indices
In btintel_pcie_msix_rx_handle(), the driver processes RX completion descriptors (urbd1) written by the PCIe device into DMA-coherent memory. urbd1->frbd_tag (a 16-bit field fully controlled by the device firmware via DMA) is used directly as an array index into rxq->bufs[] without any bounds check. rxq->bufs[] has only BTINTEL_PCIE_RX_DESCS_COUNT (64) entries, while frbd_tag can be any value 0-65535. A malicious or malfunctioning device can write an out-of-range frbd_tag, causing the driver to dereference an out-of-bounds data_buf pointer.
Additionally, cr_hia is read from a DMA-shared index array also writable by the device; if the device sets cr_hia >= rxq->count, the while-loop never terminates because cr_tia is wrapped via modulo rxq->count and can never equal an out-of-range cr_hia.
Add bounds validation for cr_hia and frbd_tag in the RX path, and cr_hia in the TX path. Log invalid values with bt_dev_err before returning.
This page as .md · .json · in your agent: get_signal("CVE-2026-98601")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.