CVE-2026-98601

What it actually does

Missing bounds checks on device-controlled DMA indices (frbd_tag and cr_hia) allow out-of-bounds array access or infinite loops in the btintel_pcie RX/TX paths.

Why it matters to the business

A malicious or faulty PCIe Bluetooth device can crash the kernel or trigger memory corruption on affected Linux systems, leading to denial of service or potential privilege escalation with no user interaction required.

How an attack unfolds

An attacker with a malicious PCIe device or compromised firmware supplies an out-of-range frbd_tag or cr_hia value via DMA-coherent memory; the driver uses the value directly as an array index or loop bound without validation, dereferencing invalid memory or spinning forever.

How to fix it

Upgrade to a Linux kernel containing the bounds validation patches for cr_hia and frbd_tag in btintel_pcie; apply the fix from the referenced commit that adds bt_dev_err logging and early returns on invalid values.

How to confirm the fix worked

Confirm the presence of bounds checks on frbd_tag before indexing rxq->bufs[] and on cr_hia before entering the RX/TX while loops; test with a device emulator that supplies values >=64 and >=rxq->count respectively.

Typical attack path

1. Attacker provisions or compromises a PCIe Bluetooth device capable of writing arbitrary DMA values.
2. Device writes out-of-range frbd_tag into RX completion descriptors or invalid cr_hia into shared index arrays.
3. Driver in btintel_pcie_msix_rx_handle reads the uncontrolled value and performs unchecked array access or loop termination test.
4. Resulting out-of-bounds dereference or infinite loop causes kernel panic or memory corruption.

How to detect it

Inspect kernel logs for bt_dev_err messages referencing invalid frbd_tag or cr_hia values; examine crash dumps showing out-of-bounds accesses in btintel_pcie_msix_rx_handle or related functions.

What your security team should do

• Prioritize kernel updates on systems exposing the btintel_pcie driver within the next 30 days given the 5-day-old disclosure.
• Disable the btintel_pcie driver via module blacklist if Bluetooth PCIe hardware is not required.
• Monitor vendor advisories for backported fixes in distribution kernels.