All vulnerabilities
CVE-2026-98392

Linux: Bluetooth: btintel_pcie: fix tx_handle bounds off-by-one

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.21%Chance of exploitation activity in the next 30 days, higher than 10% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in72bbd7c815ef92399b7b109977ae4669ce22ee6eAlso 932a87444107e6724d808082676bba5c915c98ad, 3dd1b41f96aad08444be1b7626c89de2b9f2abd4CVE List
Published14 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 72bbd7c815ef92399b7b109977ae4669ce22ee6eLinuxCVE List
  • 932a87444107e6724d808082676bba5c915c98adLinuxCVE List
  • 3dd1b41f96aad08444be1b7626c89de2b9f2abd4LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btintel_pcie: fix tx_handle bounds off-by-one

Valid indices into txq->urbd0s/tfds/bufs are 0..txq->count-1, so tfd_index == txq->count is already out of range. Change the guard in btintel_pcie_msix_tx_handle() from '> txq->count' to '>= txq->count'.

This issue was reported by Claude Mythos.

Text from CVE List

Affected versions 10

  • Linuxaffected: c2b636b3f788d10486a6691ad6dd3ec4c93bd78e before 72bbd7c815ef92399b7b109977ae4669ce22ee6eCVE List
  • Linuxaffected: c2b636b3f788d10486a6691ad6dd3ec4c93bd78e before 932a87444107e6724d808082676bba5c915c98adCVE List
  • Linuxaffected: c2b636b3f788d10486a6691ad6dd3ec4c93bd78e before a641201a9b4d69ee8a7ef35f7aa597dddee6b9eeCVE List
  • Linuxaffected: c2b636b3f788d10486a6691ad6dd3ec4c93bd78e before 3dd1b41f96aad08444be1b7626c89de2b9f2abd4CVE List
  • Linuxaffected: 6.10CVE List
  • Linuxunaffected: all versions before 6.10CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2.7 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 4