CVE-2026-98601: Bluetooth: btintel_pcie: validate device-supplied DMA indices
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: btintelpcie: validate device-supplied DMA indices
In btintelpciemsixrxhandle(), the driver processes RX completion descriptors (urbd1) written by the PCIe device into DMA-coherent memory. urbd1->frbdtag (a 16-bit field fully controlled by the device firmware via DMA) is used directly as an array index into rxq->bufs[] without any bounds check. rxq->bufs[] has only BTINTELPCIERXDESCSCOUNT (64) entries, while frbdtag can be any value 0-65535. A malicious or malfunctioning device can write an out-of-range frbdtag, causing the driver to dereference an out-of-bounds databuf pointer.
Additionally, crhia is read from a DMA-shared index array also writable by the device; if the device sets crhia >= rxq->count, the while-loop never terminates because crtia is wrapped via modulo rxq->count and can never equal an out-of-range crhia.
Add bounds validation for crhia and frbdtag in the RX path, and crhia in the TX path. Log invalid values with btdeverr before returning.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.112 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.55 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.9 - Compensating control
Add bounds validation for device-supplied cr_hia and frbd_tag in the RX path, and for cr_hia in the TX path; log invalid values with bt_dev_err before returning.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel's btintel_pcie Bluetooth driver with a PCIe Bluetooth device are exposed. The malformed values originate from device firmware through DMA, so the relevant threat source is a malicious or malfunctioning PCIe Bluetooth device or its firmware.
What can a malicious or faulty device cause?
An out-of-range RX buffer tag can make the driver dereference an out-of-bounds buffer pointer. An invalid device-supplied completion index can also cause the RX processing loop not to terminate; the fix additionally validates the corresponding TX completion index.
How can I identify attempted or active exploitation after applying the fix?
The corrected driver logs invalid DMA-supplied index values with bt_dev_err before returning. Review kernel or driver logs for btintel_pcie invalid-value errors.