CVE-2026-98291

What it actually does

Off-by-one error in btintel_pcie_submit_rx() allows frbd_index == rxq->count to pass the bounds check and index one element past the end of the FRBD array, enabling an out-of-bounds access in the Linux kernel Bluetooth PCIe driver.

Why it matters to the business

Linux systems using affected Intel PCIe Bluetooth hardware risk kernel instability, crashes, or potential privilege escalation, which can disrupt wireless connectivity and require unplanned reboots or patches across fleets.

How an attack unfolds

An attacker with local access or the ability to influence RX submission in the btintel_pcie driver triggers the flawed bounds check, causing an out-of-bounds array access that may be leveraged for memory corruption or denial of service.

How to fix it

Update the Linux kernel to a version containing the fix that changes the guard condition from > rxq->count to >= rxq->count in btintel_pcie_submit_rx(). Rebuild and deploy the patched kernel module or distribution package.

How to confirm the fix worked

Inspect the btintel_pcie driver source for the corrected bounds check (>= rxq->count) and confirm the change is present after patching; test RX submission paths under load to verify no out-of-bounds behavior occurs.

Typical attack path

1. Obtain local execution context or trigger Bluetooth RX path on vulnerable kernel
2. Cause btintel_pcie_submit_rx() to receive an index equal to rxq->count
3. Bypass the incorrect > check and perform out-of-bounds memory access
4. Leverage resulting corruption for crash or further exploitation

How to detect it

Review kernel logs for oops, panics, or warnings referencing btintel_pcie_submit_rx() or FRBD array access violations; correlate with Bluetooth activity or recent driver loads.

• btintel_pcie_submit_rx
• frbd_index
• rxq->count

What your security team should do

• Prioritize kernel updates for systems exposing Intel PCIe Bluetooth hardware
• Monitor for kernel oops or panics involving btintel_pcie
• Apply patches within standard maintenance windows given low exploit maturity