{"id":"CVE-2026-99094","kind":"vulnerability","aliases":["CVE-2026-99094"],"related":[],"title":"Linux kernel: Bluetooth Intel PCIe driver TX descriptor bounds check flaw","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btintel_pcie: fix TX descriptor bounds check\n\nbtintel_pcie_prepare_tx() uses tfd_index to access the TFD and data\nbuffer arrays before the index is advanced modulo txq->count. An index\nequal to txq->count is one past the end of both arrays, so reject it in\nthe bounds check.","summary":"The Intel PCIe Bluetooth driver in the Linux kernel used a transmit descriptor index that could equal the queue size, reading one entry past the end of the arrays. The sources do not state what an attacker gains from this out-of-bounds access.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bluetooth","infrastructure","intel-pcie","linux-kernel"],"not_affected_if":["no-intel-pcie-bluetooth"],"how_to_check":"- `uname -r` to see the running kernel version\n- `lspci | grep -i bluetooth` to check whether an Intel PCIe Bluetooth controller is present\n- unknown whether the sources list affected kernel versions","fix":"- Update to a Linux kernel release that includes the btintel_pcie bounds check fix; the sources do not name the fixed version\n- unknown whether a distribution kernel package already carries the fix","status":"open","published_at":"2026-10-26T15:16:48+00:00","first_seen_at":"2026-10-26T16:02:26+00:00","triaged_at":"2026-10-26T16:04:06+00:00","updated_at":"2026-10-26T16:04:06+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-10-26T16:04:06Z","model":"claude-haiku-5-5","output":{"fix":"- Update to a Linux kernel release that includes the btintel_pcie bounds check fix; the sources do not name the fixed version\n- unknown whether a distribution kernel package already carries the fix","reach":"local","title":"Linux kernel: Bluetooth Intel PCIe driver TX descriptor bounds check flaw","impact":"low","summary":"The Intel PCIe Bluetooth driver in the Linux kernel used a transmit descriptor index that could equal the queue size, reading one entry past the end of the arrays. The sources do not state what an attacker gains from this out-of-bounds access.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","bluetooth","intel-pcie"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown; sources do not describe the impact of the out-of-bounds access","analyst_note":"Check the NVD entry and the upstream kernel commit for the fixed version, exploitability, and the attacker's reach.","how_to_check":"- `uname -r` to see the running kernel version\n- `lspci | grep -i bluetooth` to check whether an Intel PCIe Bluetooth controller is present\n- unknown whether the sources list affected kernel versions","needs_analyst":true,"not_affected_if":["no-intel-pcie-bluetooth"],"who_is_affected":"Systems running a Linux kernel with the btintel_pcie driver, which handles Intel PCIe Bluetooth controllers, are in scope. Systems without an Intel PCIe Bluetooth controller or with the driver absent are likely not exposed, but the sources do not confirm this. Other hardware and kernel configurations are unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000648,"input_tokens":3354,"output_tokens":626,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-99094':14A,17A 'access':70B,97C 'advanc':108C 'array':54B,103C,125C 'attack':62B 'bluetooth':3A,18B,29B,81C 'bound':9A,69B,87C,131C 'btintel':82C,89C 'buffer':102C 'check':10A,88C,132C 'could':41B 'count':111C,117C 'cve':12A,15A 'data':101C 'descriptor':8A,38B,86C 'driver':6A,30B 'end':51B,122C 'entri':48B 'equal':42B,114C 'fix':84C 'flaw':11A 'follow':76C 'gain':63B 'index':39B,95C,106C,113C 'infrastructur':19B 'intel':4A,21B,27B 'intel-pci':20B 'kernel':2A,25B,34B,74C 'linux':1A,24B,33B,73C 'linux-kernel':23B 'modulo':109C 'one':47B,119C 'out-of-bound':66B 'past':49B,120C 'pcie':5A,22B,28B,83C,90C 'prepar':91C 'queue':44B 'read':46B 'reject':127C 'resolv':80C 'size':45B 'sourc':56B 'state':59B 'tfd':94C,99C 'transmit':37B 'tx':7A,85C,92C 'txq':110C,116C 'use':35B,93C 'vulner':77C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the btintel_pcie driver, which handles Intel PCIe Bluetooth controllers, are in scope. Systems without an Intel PCIe Bluetooth controller or with the driver absent are likely not exposed, but the sources do not confirm this. Other hardware and kernel configurations are unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T15:16:48+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99094","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99094","severity":null,"published_at":"2026-10-26T15:16:48+00:00","modified_at":"2026-10-26T15:16:48+00:00","first_seen_at":"2026-10-26T16:02:26+00:00","fetched_at":"2026-10-26T16:02:26+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}