CVE-2026-98392

What it actually does

Off-by-one error in btintel_pcie_msix_tx_handle allows tfd_index to reach txq->count, permitting out-of-bounds access to txq->urbd0s/tfds/bufs arrays beyond their valid 0..count-1 range.

Why it matters to the business

May cause kernel instability, crashes, or memory corruption on Linux systems using affected Intel PCIe Bluetooth hardware, leading to device downtime or potential privilege escalation in multi-user environments.

How an attack unfolds

An attacker with local access triggers Bluetooth transmission paths that exercise the tx_handle function under conditions where the index check fails to prevent the final invalid slot, resulting in out-of-bounds memory operations.

How to fix it

Apply the upstream kernel patch that changes the guard condition from '> txq->count' to '>= txq->count' in btintel_pcie_msix_tx_handle; rebuild and deploy updated kernel images to all affected systems.

How to confirm the fix worked

Inspect the source of btintel_pcie.c for the corrected bounds check; verify running kernel contains the fix via git log or version string comparison against the patch commit.

Typical attack path

1. Obtain local execution context on a Linux host with btintel_pcie driver loaded
2. Initiate Bluetooth activity that populates the txq structures to maximum count
3. Force repeated calls to btintel_pcie_msix_tx_handle with crafted index values
4. Trigger the off-by-one condition to perform out-of-bounds read or write

How to detect it

Review kernel logs for Bluetooth driver oops or panic entries referencing btintel_pcie_msix_tx_handle; examine system call traces involving Bluetooth socket operations preceding any crash.

What your security team should do

• Prioritize patching kernel on systems with Intel Bluetooth PCIe adapters
• Monitor for upstream stable kernel releases containing this fix
• Restrict local user access on high-risk multi-tenant hosts until updated