CVE-2026-99094None▾ SunlitIn the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel_pcie: fix TX descriptor bounds check btintel_pcie_prepare_tx() uses tfd_index to access the TFD and data buffer arrays before the index is advanced …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: btintel_pcie: fix TX descriptor bounds check
btintel_pcie_prepare_tx() uses tfd_index to access the TFD and data buffer arrays before the index is advanced modulo txq->count. An index equal to txq->count is one past the end of both arrays, so reject it in the bounds check.
Linux >= 6e65a09f927566f257322358d429b267548473eb < 08704ec6d4bf69725e7815b09a9b5c7af83e255bLinux >= 6e65a09f927566f257322358d429b267548473eb < 39ab048cce70d50af48015f5f294c4cf80d6ba89Linux >= 6e65a09f927566f257322358d429b267548473eb < 2669567615215d52fb306053cbcc1f53dc386158Linux >= 6e65a09f927566f257322358d429b267548473eb < baa53af641c9e3644e717b8dfd1b95a55a0c111bLinux 6.10Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-99092Noneriscv: patch: fix handling of bpf-jit execmem addresses
CVE-2026-99089NoneASoC: samsung: i2s: enable op_clk in probe to balance runtime PM
CVE-2026-99093Nonemm: don't schedule deferred kernel page table freeing while booting
CVE-2026-99088Nonenet: openvswitch: validate transport header presence in set_ipv6_addr
CVE-2026-99090Nonedrm/amdgpu: serialize vblank counter reads against GPU reset
CVE-2026-99097Nonetee: shm: reject zero-sized allocations in tee_dyn_shm_alloc_helper()