CVE-2026-98601

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btintel_pcie: validate device-supplied DMA indices

In btintel_pcie_msix_rx_handle(), the driver processes RX completion

descriptors (urbd1) written by the PCIe device into DMA-coherent memory.

urbd1->frbd_tag (a 16-bit field fully controlled by the device firmware

via DMA) is used directly as an array index into rxq->bufs[] without any

bounds check. rxq->bufs[] has only BTINTEL_PCIE_RX_DESCS_COUNT (64)

entries, while frbd_tag can be any value 0-65535. A malicious or

malfunctioning device can write an out-of-range frbd_tag, causing the

driver to dereference an out-of-bounds data_buf pointer.

Additionally, cr_hia is read from a DMA-shared index array also writable

by the device; if the device sets cr_hia >= rxq->count, the while-loop

never terminates because cr_tia is wrapped via modulo rxq->count and can

never equal an out-of-range cr_hia.

Add bounds validation for cr_hia and frbd_tag in the RX path, and

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References