Bluetooth PCIe TX Handle Off-by-One in Linux Kernel

Executive Summary

This is a bounds checking error in the Linux kernel's Bluetooth driver for Intel PCIe devices. The vulnerability occurs in the btintel_pcie_msix_tx_handle() function where a guard condition incorrectly uses '>' instead of '>=' when checking array indices. This allows an out-of-bounds access when txfd_index equals txq->count.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability is specific to the Linux kernel's Bluetooth subsystem and involves an off-by-one error in the btintel_pcie driver. Detection requires checking the kernel version and examining the btintel_pcie_msix_tx_handle function for the bounds check issue. No direct network or system commands are provided in the context to detect this vulnerability.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could potentially cause system instability or crashes when Bluetooth operations are performed on affected Intel PCIe devices. It may lead to memory corruption or privilege escalation in rare cases if exploited.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability is a bounds off-by-one error in the Linux kernel's Bluetooth subsystem, specifically in the btintel_pcie driver. It does not directly impact data privacy, security controls, or compliance frameworks like GDPR or HIPAA, as it relates to memory access in Bluetooth packet handling rather than data protection or access control mechanisms.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Linux kernel to the latest patched version to resolve the Bluetooth tx_handle bounds issue. Check your distribution's security updates or kernel patches for CVE-2026-98392.

Useful 0 Not Useful 0