In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel_pcie: validate device-supplied DMA indices In… (CVE-2026-98601)

The Linux kernel Bluetooth driver btintel_pcie had a vulnerability in the function btintel_pcie_msix_rx_handle() where the driver processed RX completion descriptors written by the PCIe device into DMA-coherent memory. The field urbd1->frbd_tag, controlled by device firmware, was used directly as an index into an array with only 64 entries, without bounds checking, allowing out-of-bounds pointer dereference. Furthermore, the cr_hia index read from a DMA-shared array was not validated, potentially causing an infinite loop in the RX path. The fix involved adding bounds validation for frbd_tag and cr_hia in the RX and TX paths and logging invalid values before returning.

A malicious or malfunctioning PCIe Bluetooth device could cause the Linux kernel driver to dereference out-of-bounds pointers, potentially leading to kernel memory corruption or denial of service due to infinite loops. This could affect system stability and security by allowing unexpected kernel behavior triggered by device-supplied data.

The vulnerability has been resolved by adding proper bounds validation checks in the affected driver code. Since a patch or official fix is indicated by the description stating the vulnerability has been resolved, users should update their Linux kernel to a version that includes this fix. No additional mitigation steps are specified.