CVE-2026-98601

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btintel pcie: validate device-supplied DMA indices

In btintel pcie msix rx handle(), the driver processes RX completion descriptors (urbd1) written by the PCIe device into DMA-coherent memory. urbd1->frbd tag (a 16-bit field fully controlled by the device firmware via DMA) is used directly as an array index into rxq->bufs[] without any bounds check. rxq->bufs[] has only BTINTEL PCIE RX DESCS COUNT (64) entries, while frbd tag can be any value 0-65535. A malicious or malfunctioning device can write an out-of-range frbd tag, causing the driver to dereference an out-of-bounds data buf pointer.

Additionally, cr hia is read from a DMA-shared index array also writable by the device; if the device sets cr hia >= rxq->count, the while-loop never terminates because cr tia is wrapped via modulo rxq->count and can never equal an out-of-range cr hia.

Add bounds validation for cr hia and frbd tag in the RX path, and cr hia in the TX path. Log invalid values with bt dev err before returning.