CVE-2026-99094 in Linux
Summary
by MITRE • 10/26/2026
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: btintel_pcie: fix TX descriptor bounds check
btintel_pcie_prepare_tx() uses tfd_index to access the TFD and data buffer arrays before the index is advanced modulo txq->count. An index equal to txq->count is one past the end of both arrays, so reject it in the bounds check.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/26/2026
The Linux kernel Bluetooth subsystem contains a critical logic error within the Intel PCIe driver component that allows for out-of-bounds memory access during transmission descriptor preparation. Specifically, the function btintel_pcie_prepare_tx utilizes an index variable named tfd_index to locate entries in both the Transmission Frame Descriptor (TFD) array and the associated data buffer arrays before performing modular arithmetic on the value relative to the queue count. This sequence of operations creates a race condition-like scenario where the index can temporarily hold a value exactly equal to txq->count, which represents an offset one position beyond the valid range of zero-indexed arrays in C-based systems. Because array indexing begins at zero, an index matching the total count points to memory immediately following the allocated buffer structures rather than within them, leading to invalid pointer dereferences when subsequent operations attempt to read from or write to these locations.
This vulnerability is classified under CWE-125, which describes Out-of-bounds Read vulnerabilities, and potentially CWE-787, an out-of-bounds Write if the driver attempts to populate descriptors at this invalid location before validation occurs. From a threat modeling perspective aligned with MITRE ATT&CK techniques such as T1068 Exploitation for Privilege Escalation or T1203 Exploitation for Client Execution, exploiting this flaw could allow an attacker who has local access to the system to trigger kernel memory corruption. The immediate operational impact includes potential kernel panics resulting in denial of service conditions where the Bluetooth subsystem crashes and requires a full system reboot. More severely, if the out-of-bounds access overlaps with sensitive kernel data structures or control flow mechanisms, it could facilitate arbitrary code execution with root privileges by overwriting function pointers or return addresses within the kernel space memory layout.
The root cause lies in insufficient boundary validation prior to array indexing operations. The original implementation failed to ensure that the tfd_index remained strictly less than txq->count before being used as an offset for accessing static arrays defined elsewhere in the driver module. By rejecting indices equal to the queue count, the patch enforces strict adherence to valid memory ranges allocated during device initialization. This correction ensures that all descriptor accesses remain within the bounds of physically mapped and kernel-managed memory regions associated with the Bluetooth PCIe interface hardware interaction layer.
Mitigation strategies primarily involve applying the upstream Linux kernel patches that address this specific logic flaw in the btintel_pcie driver module. System administrators should monitor for available security updates from their distribution vendors, as these typically include backported fixes for critical kernel vulnerabilities. For environments where immediate patching is not feasible, restricting local user access to Bluetooth configuration utilities and disabling unnecessary wireless interfaces can reduce the attack surface by limiting opportunities for triggering the vulnerable code path through crafted ioctl calls or device state transitions that invoke the transmission preparation routine.