CVE-2026-99094
kernel: Bluetooth: btintel_pcie: fix TX descriptor bounds check
Severity
ModerateRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · October 26, 2026
Updated · November 1, 2026
Description
A flaw was found in the Linux kernel's Intel Bluetooth PCIe driver. An off-by-one bounds check fails to properly validate the transmission descriptor index against the queue limit during packet preparation. A local attacker could exploit this issue to trigger an out-of-bounds memory access, leading to memory corruption and a Denial of Service (DoS) via a system crash.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-193 · Off-by-one Error