CVE-2026-98601

A flaw was found in the Linux kernel's Intel Bluetooth PCIe driver. The driver fails to validate index values provided by the hardware device through Direct Memory Access (DMA). A malicious or compromised PCIe device could supply out-of-range indices to trigger an out-of-bounds memory dereference or an infinite loop, resulting in a system crash and Denial of Service (DoS).

This vulnerability is rated as having a Moderate impact for Red Hat Enterprise Linux because exploitation requires a compromised physical or emulated PCIe peripheral, limiting the attack vector to environments with direct hardware access or virtualized PCIe device assignment. In standard server deployments, Bluetooth hardware is infrequently present or active, significantly reducing overall exposure. If an attacker controls the underlying PCIe device, they can trigger an unexpected kernel hang or crash, resulting in a local denial of service without directly allowing privilege escalation or information leakage.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.