---
id: "CVE-2026-98601"
kind: "vulnerability"
aliases: ["CVE-2026-98601"]
title: "Linux kernel: Bluetooth Intel PCIe driver trusts device-supplied DMA indices"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["bluetooth", "intel-pcie", "linux-kernel", "package"]
not_affected_if: ["no-intel-pcie-bluetooth"]
published_at: "2026-10-18T16:17:12+00:00"
first_seen_at: "2026-10-23T21:57:16+00:00"
updated_at: "2026-10-25T05:21:34+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98601", "first_seen_at": "2026-10-23T21:57:16+00:00"}]
---

# Linux kernel: Bluetooth Intel PCIe driver trusts device-supplied DMA indices

The Linux kernel's Intel PCIe Bluetooth driver uses index values written by the device into shared DMA memory without bounds checks, so an out-of-range value can index past a buffer array. A malicious or faulty Bluetooth device can cause an out-of-bounds access or a hang in the kernel driver.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- unknown

## Fix

- Update to a Linux kernel release that includes the upstream fix titled 'Bluetooth: btintel_pcie: validate device-supplied DMA indices' (version unknown from sources)

## Timeline

- 2026-10-23T21:57:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-98601

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btintel_pcie: validate device-supplied DMA indices

In btintel_pcie_msix_rx_handle(), the driver processes RX completion
descriptors (urbd1) written by the PCIe device into DMA-coherent memory.
urbd1->frbd_tag (a 16-bit field fully controlled by the device firmware
via DMA) is used directly as an array index into rxq->bufs[] without any
bounds check. rxq->bufs[] has only BTINTEL_PCIE_RX_DESCS_COUNT (64)
entries, while frbd_tag can be any value 0-65535. A malicious or
malfunctioning device can write an out-of-range frbd_tag, causing the
driver to dereference an out-of-bounds data_buf pointer.

Additionally, cr_hia is read from a DMA-shared index array also writable
by the device; if the device sets cr_hia >= rxq->count, the while-loop
never terminates because cr_tia is wrapped via modulo rxq->count and can
never equal an out-of-range cr_hia.

Add bounds validation for cr_hia and frbd_tag in the RX path, and cr_hia
in the TX path. Log invalid values with bt_dev_err before returning.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_