{"id":"CVE-2026-98601","kind":"vulnerability","aliases":["CVE-2026-98601"],"related":[],"title":"Linux kernel: Bluetooth Intel PCIe driver trusts device-supplied DMA indices","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btintel_pcie: validate device-supplied DMA indices\n\nIn btintel_pcie_msix_rx_handle(), the driver processes RX completion\ndescriptors (urbd1) written by the PCIe device into DMA-coherent memory.\nurbd1->frbd_tag (a 16-bit field fully controlled by the device firmware\nvia DMA) is used directly as an array index into rxq->bufs[] without any\nbounds check. rxq->bufs[] has only BTINTEL_PCIE_RX_DESCS_COUNT (64)\nentries, while frbd_tag can be any value 0-65535. A malicious or\nmalfunctioning device can write an out-of-range frbd_tag, causing the\ndriver to dereference an out-of-bounds data_buf pointer.\n\nAdditionally, cr_hia is read from a DMA-shared index array also writable\nby the device; if the device sets cr_hia >= rxq->count, the while-loop\nnever terminates because cr_tia is wrapped via modulo rxq->count and can\nnever equal an out-of-range cr_hia.\n\nAdd bounds validation for cr_hia and frbd_tag in the RX path, and cr_hia\nin the TX path. Log invalid values with bt_dev_err before returning.","summary":"The Linux kernel's Intel PCIe Bluetooth driver uses index values written by the device into shared DMA memory without bounds checks, so an out-of-range value can index past a buffer array. A malicious or faulty Bluetooth device can cause an out-of-bounds access or a hang in the kernel driver.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bluetooth","intel-pcie","linux-kernel","package"],"not_affected_if":["no-intel-pcie-bluetooth"],"how_to_check":"- unknown","fix":"- Update to a Linux kernel release that includes the upstream fix titled 'Bluetooth: btintel_pcie: validate device-supplied DMA indices' (version unknown from sources)","status":"open","published_at":"2026-10-18T16:17:12+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:21:34+00:00","updated_at":"2026-10-25T05:21:34+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T05:21:34Z","model":"claude-haiku-5-5","output":{"fix":"- Update to a Linux kernel release that includes the upstream fix titled 'Bluetooth: btintel_pcie: validate device-supplied DMA indices' (version unknown from sources)","reach":"local","title":"Linux kernel: Bluetooth Intel PCIe driver trusts device-supplied DMA indices","impact":"high","summary":"The Linux kernel's Intel PCIe Bluetooth driver uses index values written by the device into shared DMA memory without bounds checks, so an out-of-range value can index past a buffer array. A malicious or faulty Bluetooth device can cause an out-of-bounds access or a hang in the kernel driver.","category":"package","nicknames":[],"who_cares":["linux-kernel","bluetooth","intel-pcie"],"confidence":0.5,"needs_auth":"no","worst_case":"malicious device causes out-of-bounds kernel memory access","analyst_note":"Check the kernel.org stable commit for the btintel_pcie validation fix to get affected and fixed kernel versions, and confirm whether an attacker reaches this over the air or needs physical PCIe access.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-intel-pcie-bluetooth"],"who_is_affected":"Systems running a Linux kernel with the btintel_pcie driver, which handles Intel Bluetooth controllers attached over PCIe. The sources do not say which kernel versions are affected or whether a default build loads this driver, so the exposure of a given machine is unknown.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00065,"input_tokens":3652,"output_tokens":569,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-65535':173C '-98601':15A,18A '0':172C '16':129C '64':163C 'access':75B 'add':252C 'addit':201C 'also':213C 'array':61B,145C,212C 'bit':130C 'bluetooth':3A,19B,33B,66B,93C 'bound':47B,74B,152C,197C,253C 'bt':276C 'btintel':94C,103C,158C 'buf':149C,155C,199C 'buffer':60B 'caus':69B,188C 'check':48B,153C 'coher':123C 'complet':112C 'control':133C 'count':162C,225C,240C 'cr':202C,222C,233C,250C,256C,266C 'cve':13A,16A 'data':198C 'derefer':192C 'desc':161C 'descriptor':113C 'dev':277C 'devic':9A,41B,67B,98C,119C,136C,178C,217C,220C 'device-suppli':8A,97C 'direct':142C 'dma':11A,44B,100C,122C,139C,209C 'dma-coher':121C 'dma-shar':208C 'driver':6A,34B,82B,109C,190C 'entri':164C 'equal':244C 'err':278C 'faulti':65B 'field':131C 'firmwar':137C 'follow':88C 'frbd':126C,166C,186C,259C 'fulli':132C 'handl':107C 'hang':78B 'hia':203C,223C,251C,257C,267C 'index':36B,57B,146C,211C 'indic':12A,101C 'intel':4A,21B,31B 'intel-pci':20B 'invalid':273C 'kernel':2A,25B,29B,81B,86C 'linux':1A,24B,28B,85C 'linux-kernel':23B 'log':272C 'loop':229C 'malfunct':177C 'malici':63B,175C 'memori':45B,124C 'modulo':238C 'msix':105C 'never':230C,243C 'out-of-bound':71B,194C 'out-of-rang':51B,182C,246C 'packag':26B 'past':58B 'path':264C,271C 'pcie':5A,22B,32B,95C,104C,118C,159C 'pointer':200C 'process':110C 'rang':54B,185C,249C 'read':205C 'resolv':92C 'return':280C 'rx':106C,111C,160C,263C 'rxq':148C,154C,224C,239C 'set':221C 'share':43B,210C 'suppli':10A,99C 'tag':127C,167C,187C,260C 'termin':231C 'tia':234C 'trust':7A 'tx':270C 'urbd1':114C,125C 'use':35B,141C 'valid':96C,254C 'valu':37B,55B,171C,274C 'via':138C,237C 'vulner':89C 'while-loop':227C 'without':46B,150C 'wrap':236C 'writabl':214C 'write':180C 'written':38B,115C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the btintel_pcie driver, which handles Intel Bluetooth controllers attached over PCIe. The sources do not say which kernel versions are affected or whether a default build loads this driver, so the exposure of a given machine is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:12+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98601","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98601","severity":null,"published_at":"2026-10-18T16:17:12+00:00","modified_at":"2026-10-19T10:19:21+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}