CVE-2026-99094: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-99094 is a bounds check bypass vulnerability in the Linux kernel's Bluetooth btintel_pcie driver, specifically in the btintel_pcie_prepare_tx() function. The flaw allows a local attacker to perform an out-of-bounds memory write by triggering Bluetooth PCIe TX operations with a tfd_index value equal to txq->count, which is one past the end of the TFD and data buffer arrays. The vulnerability was published on October 26, 2026, and affects Linux kernel versions starting from 6.10 up to fixed releases in the 6.12, 6.18, and 7.2 stable branches. The CVSS estimate is Medium severity (GitHub Advisory, Feedly).

The root cause is an improper bounds check (CWE-125/CWE-787 — out-of-bounds read/write) in btintel_pcie_prepare_tx() within the btintel_pcie Bluetooth driver. The function uses tfd_index to index into the TFD and data buffer arrays before advancing the index modulo txq->count; when tfd_index equals txq->count, it is exactly one element past the end of both arrays, bypassing the intended bounds check and allowing an out-of-bounds memory access. Exploitation requires local access and the ability to trigger Bluetooth HCI socket operations on a system with an Intel PCIe Bluetooth adapter. No public proof-of-concept code has been identified (GitHub Advisory, Feedly).

Successful exploitation allows a local user to write out-of-bounds to kernel memory immediately following the TFD and data buffer arrays, potentially leading to arbitrary code execution with kernel privileges. This could result in full system compromise, privilege escalation from a local unprivileged user to root, and complete loss of confidentiality, integrity, and availability of the affected system. The scope is limited to systems running Linux kernel 6.10 or later with Intel PCIe Bluetooth hardware (GitHub Advisory, Feedly).

There is no evidence of active in-the-wild exploitation, and no public proof-of-concept exploit has been published as of the disclosure date. The vulnerability requires local access to the target system and the presence of Intel PCIe Bluetooth hardware, which limits the attack surface. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, Feedly).

Patches have been backported to stable kernel branches: 6.12.113, 6.18.57, 7.2.11, and the 7.3 mainline release. Users should update to one of these fixed versions as the primary remediation. As a temporary workaround, administrators can restrict user-space access to Bluetooth HCI socket operations (e.g., via capability restrictions or disabling the btintel_pcie module if Intel PCIe Bluetooth is not required) and monitor for anomalous Bluetooth PCIe TX activity (GitHub Advisory, Feedly).