Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2026-99094

Bluetooth: btintel_pcie: fix TX descriptor bounds check

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel_pcie: fix TX descriptor bounds check btintel_pcie_prepare_tx() uses tfd_index to access the TFD and data buffer arrays before the index is advanced modulo txq->count. An index equal to txq->count is one past the end of both arrays, so reject it in the bounds check.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 6e65a09f927566f257322358d429b267548473eb to < 08704ec6d4bf69725e7815b09a9b5c7af83e255baffected
  • 6e65a09f927566f257322358d429b267548473eb to < 39ab048cce70d50af48015f5f294c4cf80d6ba89affected
  • 6e65a09f927566f257322358d429b267548473eb to < 2669567615215d52fb306053cbcc1f53dc386158affected
  • 6e65a09f927566f257322358d429b267548473eb to < baa53af641c9e3644e717b8dfd1b95a55a0c111baffected

Linux Linux

Default version status: affected

  • 6.10affected
  • 0 to < 6.10unaffected
  • 6.12.113 to ≤ 6.12.*unaffected
  • 6.18.57 to ≤ 6.18.*unaffected
  • 7.2.11 to ≤ 7.2.*unaffected
  • 7.3 to ≤ *unaffected

References