UBUNTU-CVE-2026-99094: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: fix TX descriptor bounds check btintelpciepreparetx() uses tfdindex to access the TFD and data buffer arrays before the index is advanced modulo txq->count. An index equal to txq->count is one past the end of both arrays, so reject it in the bounds check.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In btintel_pcie_prepare_tx(), reject tfd_index values equal to txq->count in the bounds check, since that index is one past the end of both the TFD and data buffer arrays.
Event History
Frequently Asked Questions
What condition triggers the out-of-bounds access?
The issue occurs when btintel_pcie_prepare_tx() receives a transmit-descriptor index equal to txq->count. That value is one position beyond the valid TFD and data-buffer array bounds before the index is reduced modulo the queue count.
Which Ubuntu kernel package families are listed as affected?
The listed software includes ubuntu/linux, ubuntu/linux-riscv, ubuntu/linux-realtime, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-azure-fde, ubuntu/linux-hwe-edge, and ubuntu/linux-gke.
How can I determine whether a system contains the fix?
Check whether the installed kernel incorporates the upstream stable change identified by commit baa53af641c9e3644e717b8dfd1b95a55a0c111b. The provided data does not identify Ubuntu package versions containing the fix.