CVE-2026-98601
Received Received - Intake

Bluetooth: btintel_pcie DMA Index Validation Flaw

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel_pcie: validate device-supplied DMA indices In btintel_pcie_msix_rx_handle(), the driver processes RX completion descriptors (urbd1) written by the PCIe device into DMA-coherent memory. urbd1->frbd_tag (a 16-bit field fully controlled by the device firmware via DMA) is used directly as an array index into rxq->bufs[] without any bounds check. rxq->bufs[] has only BTINTEL_PCIE_RX_DESCS_COUNT (64) entries, while frbd_tag can be any value 0-65535. A malicious or malfunctioning device can write an out-of-range frbd_tag, causing the driver to dereference an out-of-bounds data_buf pointer. Additionally, cr_hia is read from a DMA-shared index array also writable by the device; if the device sets cr_hia >= rxq->count, the while-loop never terminates because cr_tia is wrapped via modulo rxq->count and can never equal an out-of-range cr_hia. Add bounds validation for cr_hia and frbd_tag in the RX path, and cr_hia in the TX path. Log invalid values with bt_dev_err before returning.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98601
EUVD
EUVD-2026-103646

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
Linux Linux c2b636b3f788d10486a6691ad6dd3ec4c93bd78e
Linux Linux c2b636b3f788d10486a6691ad6dd3ec4c93bd78e
Linux Linux c2b636b3f788d10486a6691ad6dd3ec4c93bd78e
Linux Linux c2b636b3f788d10486a6691ad6dd3ec4c93bd78e
Linux Linux 6.10

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the Linux kernel's Bluetooth driver for Intel PCIe devices. It allows a malicious or malfunctioning device to write invalid DMA indices that bypass bounds checks. Specifically, the driver uses device-controlled values as array indices without validation, leading to out-of-bounds memory access.

Detection Guidance

This vulnerability affects the Linux kernel's Bluetooth driver for Intel PCIe devices. Detection requires checking kernel logs for Bluetooth-related errors or examining the btintel_pcie driver for out-of-bounds access patterns. No specific commands are provided in the context to directly detect this issue.

Impact Analysis

This flaw could allow an attacker with access to a vulnerable system to cause memory corruption, crashes, or potentially execute arbitrary code. It may also enable denial-of-service conditions by triggering kernel panics or system instability.

Mitigation Strategies

Apply the Linux kernel patch that adds bounds validation for frbd_tag and cr_hia in the btintel_pcie driver. Update to a kernel version containing the fix. If immediate patching is not possible, disable Bluetooth functionality or restrict device access until the patch is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98601. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart