high7.5
CVE-2026-99094
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel_pcie: fix TX descriptor bounds check btintel_pcie_prepare_tx() uses tfd_…
Impact
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel_pcie: fix TX descriptor bounds check btintel_pcie_prepare_tx() uses tfd_index to access the TFD and data buffer arrays before the index is advanced modulo txq->count. An index equal to txq->count is one past the end of both arrays, so reject it in the bounds check.
Affected packages
This record carries no package version data, so it cannot be matched against a dependency list automatically. Read the advisory and compare your version by hand.
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-98q5-q956-c5v5
- https://nvd.nist.gov/vuln/detail/CVE-2026-99094
- https://git.kernel.org/stable/c/08704ec6d4bf69725e7815b09a9b5c7af83e255b
- https://git.kernel.org/stable/c/2669567615215d52fb306053cbcc1f53dc386158
- https://git.kernel.org/stable/c/39ab048cce70d50af48015f5f294c4cf80d6ba89
- https://git.kernel.org/stable/c/baa53af641c9e3644e717b8dfd1b95a55a0c111b