CVE-2026-98601: Bluetooth: btintel_pcie: validate device-supplied DMA indices
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: btintelpcie: validate device-supplied DMA indices
In btintelpciemsixrxhandle(), the driver processes RX completion descriptors (urbd1) written by the PCIe device into DMA-coherent memory. urbd1->frbdtag (a 16-bit field fully controlled by the device firmware via DMA) is used directly as an array index into rxq->bufs[] without any bounds check. rxq->bufs[] has only BTINTELPCIERXDESCSCOUNT (64) entries, while frbdtag can be any value 0-65535. A malicious or malfunctioning device can write an out-of-range frbdtag, causing the driver to dereference an out-of-bounds databuf pointer.
Additionally, crhia is read from a DMA-shared index array also writable by the device; if the device sets crhia >= rxq->count, the while-loop never terminates because crtia is wrapped via modulo rxq->count and can never equal an out-of-range crhia.
Add bounds validation for crhia and frbdtag in the RX path, and crhia in the TX path. Log invalid values with btdeverr before returning.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In btintel_pcie_msix_rx_handle(), validate that the device-supplied cr_hia is less than rxq->count and that frbd_tag is within the rxq->bufs[] bounds (BTINTEL_PCIE_RX_DESCS_COUNT, 64) before using either value as an array index or processing RX completions; log invalid values with bt_dev_err before returning.