Live › vulnerability › CVE-2026-99094
Go to dashboardThe Intel PCIe Bluetooth driver in the Linux kernel used a transmit descriptor index that could equal the queue size, reading one entry past the end of the arrays. The sources do not state what an attacker gains from this out-of-bounds access.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 16:02 UTC. All times on this page are UTC.
Systems running a Linux kernel with the btintel_pcie driver, which handles Intel PCIe Bluetooth controllers, are in scope. Systems without an Intel PCIe Bluetooth controller or with the driver absent are likely not exposed, but the sources do not confirm this. Other hardware and kernel configurations are unknown.
No product ranges from the sources yet.
uname -r to see the running kernel versionlspci | grep -i bluetooth to check whether an Intel PCIe Bluetooth controller is presentEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: btintel_pcie: fix TX descriptor bounds check
btintel_pcie_prepare_tx() uses tfd_index to access the TFD and data buffer arrays before the index is advanced modulo txq->count. An index equal to txq->count is one past the end of both arrays, so reject it in the bounds check.
This page as .md · .json · in your agent: get_signal("CVE-2026-99094")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.