PT-2026-123381

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.12.113 Linux kernel versions prior to 6.18.57 Description An out-of-bounds access issue exists in the btintel pcie Bluetooth driver. The btintel pcie prepare tx function uses the tfd index variable to access th...

PT-2026-116949

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A buffer overflow exists in the Bluetooth component. A user-space process with HCI CHANNEL USER access can inject an oversized packet that overflows a fixed DMA buffer of 4096 bytes. Thi...

PT-2026-116820

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In the btintel pcie msix rx handle function, the driver processes RX completion descriptors written by the PCIe device into DMA-coherent memory. The frbd tag variable, a 16-bit field...

PT-2026-116950

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An integer overflow occurs in the btintel pcie recv frame function within the Bluetooth component. The variable plen is defined as a 16-bit unsigned integer u16 and is calculated by addi...

PT-2026-114371

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An off-by-one error exists in the Bluetooth component. In the btintel pcie msix tx handle function, the boundary check for indices into txq-urbd0s, txq-tfds, and txq-bufs is incorrect...

PT-2026-106625

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.10-1.1 Description An issue exists in the Bluetooth component where the btintel pcie prepare tx function copies skb-len bytes into a fixed BTINTEL PCIE BUFFER SIZE 4096 DMA slot using an unchecked memcpy. Whi...

PT-2026-106620

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.10-1.1 Description An off-by-one bounds check exists in the Bluetooth component. The function btintel pcie submit rx uses an incorrect comparison frbd index rxq-count to protect the FRBD array access. This...

PT-2026-98640

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Bluetooth component where the btintel pcie submit rx work function reads the packet len variable from rfh hdr without verifying if it exceeds the RX buffer size. A...

Linux kernel Bluetooth Buffer Overflow DoS

The vulnerability of the btintelpciesetuphdev function in the Linux kernel’s Bluetooth device support driver is related to improper control of resource identifiers “resource injection”. Exploiting this vulnerability could allow an attacker to cause a service failure...

SUSE CVE-2024-46869

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: Allocate memory for driver private data Fix driver not allocating memory for struct btinteldata which is used to store internal data...

PT-2024-32262

Name of the Vulnerable Software and Affected Versions Linux kernel versions up to 6.10.11/6.11.0 Description A vulnerability in the Linux kernel's Bluetooth component, specifically in the btintel pcie driver, has been resolved. The issue was caused by the driver not allocating memory for the...