Bluetooth: btintel_pcie: validate device-supplied DMA indices
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel_pcie: validate device-supplied DMA indices In btintel_pcie_msix_rx_handle(), the driver processes RX completion descriptors (urbd1) written by the PCIe device into DMA-coherent memory. urbd1->frbd_tag (a 16-bit field fully controlled by the device firmware via DMA) is used directly as an array index into rxq->bufs[] without any bounds check. rxq->bufs[] has only BTINTEL_PCIE_RX_DESCS_COUNT (64) entries, while frbd_tag can be any value 0-65535. A malicious or malfunctioning device can write an out-of-range frbd_tag, causing the driver to dereference an out-of-bounds data_buf pointer. Additionally, cr_hia is read from a DMA-shared index array also writable by the device; if the device sets cr_hia >= rxq->count, the while-loop never terminates because cr_tia is wrapped via modulo rxq->count and can never equal an out-of-range cr_hia. Add bounds validation for cr_hia and frbd_tag in the RX path, and cr_hia in the TX path. Log invalid values with bt_dev_err before returning.
CVE-2026-98601
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-98601
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "c2b636b3f788d10486a6691ad6dd3ec4c93bd78e",
"lessThan": "f42cd95e679d5b78611cd2208cd1c41ad0045ffa",
"versionType": "git"
},
{
"status": "affected",
"version": "c2b636b3f788d10486a6691ad6dd3ec4c93bd78e",
"lessThan": "8ec5838a35b03ac0cf3602452a369898051ffaf9",
"versionType": "git"
},
{
"status": "affected",
"version": "c2b636b3f788d10486a6691ad6dd3ec4c93bd78e",
"lessThan": "b29b70bfa12133423924fcd0327c19a802f7e368",
"versionType": "git"
},
{
"status": "affected",
"version": "c2b636b3f788d10486a6691ad6dd3ec4c93bd78e",
"lessThan": "37a11129345337efd6eef8e62b03b6348cd0dd8b",
"versionType": "git"
}
],
"programFiles": [
"drivers/bluetooth/btintel_pcie.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "6.10"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "6.10",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.55",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.9",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/bluetooth/btintel_pcie.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-98601
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #38623 · Revision 1
- Added to Heist Feed
- Publisher date