Riskcovery

CVE-2026-98291

Bluetooth: btintel_pcie: fix off-by-one bounds check in RX submit

State
Published
Severity
Not scored
Published
Oct 6, 2026
Updated
Oct 19, 2026
Reserved
Sep 25, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btintel_pcie: fix off-by-one bounds check in RX submit

btintel_pcie_submit_rx() used frbd_index > rxq->count to guard the FRBD array access, allowing frbd_index == rxq->count to pass through and index one element past the end of the array. Change the check to >= rxq->count so every out-of-range index is rejected.

This issue was reported by Claude Mythos.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • c2b636b3f788d10486a6691ad6dd3ec4c93bd78e to before b5214d72bfdf8ef7744d0c8147e6ebb09b36b259Affected
  • c2b636b3f788d10486a6691ad6dd3ec4c93bd78e to before 18464860ce27af0dccd2fc72830610b85b518cffAffected
  • c2b636b3f788d10486a6691ad6dd3ec4c93bd78e to before de4c3c72bcc6e8474f70c22427f94ca44bccd890Affected
  • c2b636b3f788d10486a6691ad6dd3ec4c93bd78e to before 2ea5a87a5a7ae58cb2662b8a7d06f209383e1765Affected
LinuxLinux
  • 6.10Affected
  • before 6.10Not affected
  • 6.12.112 through 6.12.*Not affected
  • 6.18.54 through 6.18.*Not affected
  • 7.2.8 through 7.2.*Not affected
  • 7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.