Description
In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btintel_pcie: fix TX descriptor bounds check

btintel_pcie_prepare_tx() uses tfd_index to access the TFD and data
buffer arrays before the index is advanced modulo txq->count. An index
equal to txq->count is one past the end of both arrays, so reject it in
the bounds check.
Published: 2026-10-26
Score: n/a
EPSS: n/a
KEV: No
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No solution or workaround provided in the CVE record.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 26 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-787

Mon, 26 Oct 2026 15:00:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel_pcie: fix TX descriptor bounds check btintel_pcie_prepare_tx() uses tfd_index to access the TFD and data buffer arrays before the index is advanced modulo txq->count. An index equal to txq->count is one past the end of both arrays, so reject it in the bounds check.
Title Bluetooth: btintel_pcie: fix TX descriptor bounds check
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-10-26T14:52:02.053Z

Reserved: 2026-09-25T10:25:14.390Z

Link: CVE-2026-99094

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-26T15:16:48.380

Modified: 2026-10-26T15:16:48.380

Link: CVE-2026-99094

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-26T17:15:06Z

Weaknesses