CVE-2026-98601: Linux Kernel Bluetooth Buffer Overflow

CVE-2026-98601 Overview

CVE-2026-98601 is an out-of-bounds access vulnerability in the Linux kernel's btintel_pcie Bluetooth driver. The driver's btintel_pcie_msix_rx_handle() function trusts DMA-supplied indices from the Intel PCIe Bluetooth device without validation. A malicious or malfunctioning device can write an attacker-controlled frbd_tag value outside the bounds of rxq->bufs[], causing the driver to dereference an invalid pointer. A second defect allows a device-controlled cr_hia index to trap the RX handler in an infinite loop. The kernel maintainers have resolved the issue by adding bounds validation in the RX and TX paths.

Critical Impact
A compromised or malfunctioning Intel PCIe Bluetooth device can trigger out-of-bounds memory access or a non-terminating loop in the Linux kernel, leading to memory corruption or denial of service.

Affected Products

Linux kernel btintel_pcie Bluetooth driver
Systems using Intel PCIe-based Bluetooth controllers
Kernel versions prior to the fix commits referenced in the stable tree

Discovery Timeline

2026-10-18 - CVE-2026-98601 published to NVD
2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-98601

Vulnerability Analysis

The vulnerability resides in btintel_pcie_msix_rx_handle(), the MSI-X RX completion handler for the Intel PCIe Bluetooth driver. The driver processes RX completion descriptors (urbd1) that the PCIe device writes directly into DMA-coherent memory shared between the host and the device.

Two DMA-supplied values are consumed without validation. First, urbd1->frbd_tag, a 16-bit field, is used directly as an index into rxq->bufs[]. Second, cr_hia is read from a DMA-shared index array that the device can also write.

Because the host trusts firmware-controlled memory as a source of indices, a compromised firmware image, a malicious device, or a hardware fault can steer the kernel into unsafe pointer arithmetic. This is a classic input validation failure at the kernel-device trust boundary.

Root Cause

The rxq->bufs[] array contains only BTINTEL_PCIE_RX_DESCS_COUNT (64) entries, but frbd_tag can hold any value from 0 to 65535. The driver uses frbd_tag as an array index without range checking, producing an out-of-bounds data_buf pointer when the device supplies a value of 64 or greater.

The second defect involves the RX ring consumer loop. The handler advances cr_tia using modulo rxq->count, which keeps the tail index inside the ring. If the device sets cr_hia to a value greater than or equal to rxq->count, cr_tia can never equal cr_hia, and the while loop never terminates.

Attack Vector

Exploitation requires a Bluetooth device or firmware that writes attacker-chosen values into the DMA-shared descriptor and index memory. This can occur through supply-chain compromise of the Bluetooth controller firmware, physical access scenarios involving malicious hardware, or any fault condition that produces malformed DMA writes. The resulting out-of-bounds dereference can corrupt kernel memory or crash the system, and the infinite-loop variant produces a kernel-level denial of service.

No synthetic exploitation code is published for this issue. Refer to the upstream fix commits for the exact validation logic added by maintainers.

Detection Methods for CVE-2026-98601

Indicators of Compromise

Kernel log entries emitted by the patched driver via bt_dev_err, reporting invalid frbd_tag or cr_hia values
Unexpected soft lockups or RCU stalls traced to btintel_pcie_msix_rx_handle
Kernel oops or panic messages referencing out-of-bounds access in rxq->bufs[] or data_buf

Detection Strategies

Monitor dmesg and journal output for btintel_pcie driver error messages introduced by the fix commits
Correlate Bluetooth subsystem crashes with recent firmware updates or hardware changes on affected endpoints
Track kernel version inventory to identify hosts running unpatched btintel_pcie drivers

Monitoring Recommendations

Forward kernel ring buffer events to a centralized logging platform for cross-host analysis
Alert on repeated Bluetooth driver crashes, which may indicate faulty or hostile hardware
Audit endpoints with Intel PCIe Bluetooth controllers against the kernel versions published in the stable tree fix commits

How to Mitigate CVE-2026-98601

Immediate Actions Required

Apply the latest stable kernel update containing the btintel_pcie validation fix on all affected systems
Inventory endpoints and servers that load the btintel_pcie module and prioritize them for patching
Review Bluetooth controller firmware provenance on managed devices

Patch Information

The fix adds bounds validation for cr_hia and frbd_tag in the RX path and for cr_hia in the TX path. Invalid values are logged with bt_dev_err before the handler returns. The patch is available in the following upstream commits: commit 37a11129, commit 8ec5838a, commit b29b70bf, and commit f42cd95e.

Workarounds

Blacklist the btintel_pcie module on systems that do not require Intel PCIe Bluetooth functionality
Disable Bluetooth hardware in firmware or BIOS where the feature is not needed
Restrict physical access to systems with Intel PCIe Bluetooth controllers until patches are applied

bash

# Blacklist the vulnerable module until the kernel is patched
echo "blacklist btintel_pcie" | sudo tee /etc/modprobe.d/blacklist-btintel-pcie.conf
sudo update-initramfs -u
sudo reboot