CVE-2026-99094

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: fix TX descriptor bounds check btintelpciepreparetx uses tfdindex to access the TFD and data buffer arrays before the index is advanced modulo txq-count. An index equal to txq-count is one past the end of...

CVE-2026-99094

The Linux kernel contains a vulnerability in the Bluetooth component, specifically within the btintel_pcie driver. The root cause is located in the btintel_pcie_prepare_tx() function, which uses tfd_index to access the TFD and data buffer arrays before the index is correctly advanced modulo txq-&...

CVE-2026-99094 Bluetooth: btintel_pcie: fix TX descriptor bounds check

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: fix TX descriptor bounds check btintelpciepreparetx uses tfdindex to access the TFD and data buffer arrays before the index is advanced modulo txq-count. An index equal to txq-count is one past the end of...

EUVD-2026-109900

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: fix TX descriptor bounds check btintelpciepreparetx uses tfdindex to access the TFD and data buffer arrays before the index is advanced modulo txq-count. An index equal to txq-count is one past the end of...

Linux Kernel Security Vulnerabilities

The Linux kernel has a security vulnerability. This vulnerability stems from the fact that the function btintelpciesendframe does not reject packets that exceed the value of BTINTELPCIEBUFFERSIZE minus BTINTELPCIEHCITYPELEN at the entry point. As a result, user-space processes with access to...

SUSE CVE-2026-98296

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: validate TX skb length in sendsync btintelpciepreparetx copies skb-len bytes into a fixed BTINTELPCIEBUFFERSIZE 4096 DMA slot via an unchecked memcpy. Oversized packets are currently rejected only in...

CVE-2026-98296

A vulnerability exists in the Linux kernel 's Bluetooth btintel_pcie driver. The function btintel_pcie_prepare_tx() performs an unchecked memcpy to copy skb->len bytes into a fixed DMA slot of 4096 bytes. While oversized packets are currently rejected in btintel_pcie_send_frame(), any future c...