CVE-2026-98601 in Linux
Summary
by MITRE • 10/18/2026
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: btintel_pcie: validate device-supplied DMA indices
In btintel_pcie_msix_rx_handle(), the driver processes RX completion descriptors (urbd1) written by the PCIe device into DMA-coherent memory. urbd1->frbd_tag (a 16-bit field fully controlled by the device firmware via DMA) is used directly as an array index into rxq->bufs[] without any
bounds check. rxq->bufs[] has only BTINTEL_PCIE_RX_DESCS_COUNT (64)
entries, while frbd_tag can be any value 0-65535. A malicious or malfunctioning device can write an out-of-range frbd_tag, causing the driver to dereference an out-of-bounds data_buf pointer.
Additionally, cr_hia is read from a DMA-shared index array also writable by the device; if the device sets cr_hia >= rxq->count, the while-loop never terminates because cr_tia is wrapped via modulo rxq->count and can never equal an out-of-range cr_hia.
Add bounds validation for cr_hia and frbd_tag in the RX path, and cr_hia in the TX path. Log invalid values with bt_dev_err before returning.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/18/2026
The Linux kernel Bluetooth subsystem contains a critical vulnerability within the Intel PCIe driver component that stems from insufficient input validation of device-supplied data structures. Specifically, the function btintel_pcie_msix_rx_handle processes receive completion descriptors written by the host bus adapter into DMA-coherent memory. These descriptors contain fields such as frbd_tag and cr_hia which are fully controlled by the peripheral firmware via direct memory access. The driver historically treated these values as trusted indices without performing any bounds checking against the allocated buffer sizes, creating a severe security flaw that allows for out-of-bounds memory access and potential denial of service conditions.
The primary technical flaw involves the use of frbd_tag as an array index into rxq->bufs[]. This array is statically sized with BTINTEL_PCIE_RX_DESCS_COUNT entries, which equals sixty-four elements. However, frbd_tag is a sixteen-bit field capable of holding any value between zero and sixty-five thousand five hundred thirty-five. When the device firmware writes an out-of-range value to this field, the driver dereferences an invalid data_buf pointer located outside the bounds of the allocated array. This constitutes a classic Out-of-Bounds Read vulnerability as defined by CWE-125. Depending on memory layout and kernel configuration, accessing these unallocated or protected memory regions can lead to information disclosure, where sensitive kernel data is leaked to user space through subsequent operations, or cause immediate system instability if the access triggers a page fault in an unprotected context.
A secondary but equally critical issue exists within the same processing loop involving the cr_hia field and its interaction with cr_tia. The driver reads cr_hia from a DMA-shared index array that is also writable by the device firmware. If the device sets cr_hia to a value greater than or equal to rxq->count, the subsequent while-loop condition fails to terminate correctly. This occurs because cr_tia is wrapped using modulo arithmetic based on rxq->count, meaning it will never equal an out-of-range cr_hia value. Consequently, this logic error results in an infinite loop within the kernel context, leading to a Denial of Service as defined by CWE-835. Such loops consume CPU resources indefinitely and can hang the system or specific subsystems, effectively rendering the machine unresponsive until a hard reset is performed.
From a threat modeling perspective, this vulnerability aligns with MITRE ATT&CK techniques related to privilege escalation via kernel exploitation if an attacker can trigger arbitrary code execution through the out-of-bounds read, although in many configurations it primarily serves as a local denial of service vector. The attack surface requires physical or logical access to the PCIe bus to manipulate DMA writes, which typically implies either hardware-level compromise or control over the device firmware itself. Nevertheless, for systems where Bluetooth devices are exposed via virtualization layers or shared hardware environments, this risk is significantly amplified.
The resolution implemented in the kernel involves adding strict bounds validation checks for both cr_hia and frbd_tag within the receive path of the driver. Additionally, a check was added for cr_hia in the transmit path to ensure consistency across all data flow directions. When an invalid value is detected during these validations, the driver logs the error using bt_dev_err and returns immediately, preventing further processing of the malicious descriptor. This defensive programming approach ensures that only valid indices are used for memory access, thereby eliminating both the out-of-bounds read vulnerability and the infinite loop condition. System administrators should ensure their kernels are updated to include this patch to mitigate these risks effectively.