CVE-2026-99094: Linux kernel · Bluetooth: btintel_pcie: fix TX descriptor bounds check
Affects Linux kernelSource CVE Database V5
Not known to be exploited · fixed in baa53af641c9e3644e717b8dfd1b95a55a0c111b : update Linux kernel when convenient.
Data as of 26 Oct 2026, 16:53 UTC
Rated by Threat Radar · CVSS not yet scored by NVD
- Patch
- Available – fixed in baa53af641c9e3644e717b8dfd1b95a55a0c111b, 2669567615215d52fb306053cbcc1f53dc386158, 08704ec6d4bf69725e7815b09a9b5c7af83e255b +1
Exploitation evidence
Disclosed: evidence found.
CVE published 26 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Upgrade Linux kernel to baa53af641c9e3644e717b8dfd1b95a55a0c111b, 2669567615215d52fb306053cbcc1f53dc386158, 08704ec6d4bf69725e7815b09a9b5c7af83e255b or 39ab048cce70d50af48015f5f294c4cf80d6ba89.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in– |
AI-suggested
The vulnerability has been fixed in the Linux kernel source code as indicated by the provided commit hashes. Users and administrators should update to the fixed versions or later to remediate this issue. No additional mitigation is required beyond applying the official fix.
Description
A vulnerability in the Linux kernel Bluetooth driver btintel_pcie was fixed to correct a bounds check error in the TX descriptor handling. The function btintel_pcie_prepare_tx used an index that could exceed the valid range of the transmit queue arrays, potentially leading to out-of-bounds access. This issue was addressed by rejecting an index equal to the transmit queue count, which is one past the end of the arrays.
References
- git.kernel.org/stable/c/08704ec6d4bf69725e7815b09a9b5c7af83e255b (opens in a new tab)
- git.kernel.org/stable/c/39ab048cce70d50af48015f5f294c4cf80d6ba89 (opens in a new tab)
- git.kernel.org/stable/c/2669567615215d52fb306053cbcc1f53dc386158 (opens in a new tab)
- git.kernel.org/stable/c/baa53af641c9e3644e717b8dfd1b95a55a0c111b (opens in a new tab)