CVE-2026-99094

What it actually does

The vulnerability permits an out-of-bounds array access in btintel_pcie_prepare_tx() because the bounds check on tfd_index accepts a value equal to txq->count, which indexes one past the end of the TFD and data buffer arrays.

Why it matters to the business

Systems using affected Intel PCIe Bluetooth hardware may experience kernel-level memory corruption, leading to crashes, degraded wireless functionality, or potential elevation of privileges on Linux-based devices and servers.

How an attack unfolds

An attacker with the ability to influence Bluetooth transmission operations triggers btintel_pcie_prepare_tx() with a crafted tfd_index value that passes the flawed bounds check, resulting in out-of-bounds memory access during TX descriptor preparation.

How to fix it

Update the Linux kernel to a version containing the bounds-check correction in btintel_pcie_prepare_tx(); rebuild and deploy the patched kernel image on affected systems; disable the btintel_pcie driver if Bluetooth functionality is not required.

How to confirm the fix worked

Inspect the btintel_pcie driver source for the presence of an explicit rejection of tfd_index >= txq->count before array access; verify the running kernel version against the upstream fix commit; perform Bluetooth TX stress tests to confirm absence of out-of-bounds behavior.

Typical attack path

1. Obtain local or adjacent access to a vulnerable Linux system with btintel_pcie Bluetooth hardware
2. Craft or manipulate Bluetooth traffic to cause btintel_pcie_prepare_tx() to be invoked with tfd_index equal to txq->count
3. Trigger the out-of-bounds access to corrupt kernel memory structures
4. Escalate to denial of service or attempt further exploitation of the resulting memory state

How to detect it

Review kernel logs for oops or panic entries referencing btintel_pcie_prepare_tx or TFD array accesses; examine Bluetooth stack traces for anomalous TX queue handling around the time of any system instability.

What your security team should do

• Prioritize kernel updates on all systems exposing Intel PCIe Bluetooth interfaces within the next patching cycle
• Audit Bluetooth usage and disable the module where wireless connectivity is unnecessary
• Monitor vendor advisories for backported fixes in distribution kernels