{"id":"CVE-2026-98392","revision":"ba6eeecb868d46a6bf7903e9e2f8d4ef","records":[{"revision":"ba6eeecb868d46a6bf7903e9e2f8d4ef","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-98392","aliases":[],"title":"Bluetooth: btintel_pcie: fix tx_handle bounds off-by-one","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btintel_pcie: fix tx_handle bounds off-by-one\n\nValid indices into txq->urbd0s/tfds/bufs are 0..txq->count-1, so\ntfd_index == txq->count is already out of range. Change the guard in\nbtintel_pcie_msix_tx_handle() from '> txq->count' to '>= txq->count'.\n\nThis issue was reported by Claude Mythos.","state":0,"publishedAt":"2026-10-14T13:25:56.096+00:00","modifiedAt":"2026-10-19T09:18:45.317+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/bluetooth/btintel_pcie.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"c2b636b3f788d10486a6691ad6dd3ec4c93bd78e\",\n                            \"lessThan\": \"72bbd7c815ef92399b7b109977ae4669ce22ee6e\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"c2b636b3f788d10486a6691ad6dd3ec4c93bd78e\",\n                            \"lessThan\": \"932a87444107e6724d808082676bba5c915c98ad\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"c2b636b3f788d10486a6691ad6dd3ec4c93bd78e\",\n                            \"lessThan\": \"a641201a9b4d69ee8a7ef35f7aa597dddee6b9ee\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"c2b636b3f788d10486a6691ad6dd3ec4c93bd78e\",\n                            \"lessThan\": \"3dd1b41f96aad08444be1b7626c89de2b9f2abd4\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/bluetooth/btintel_pcie.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.10\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.10\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.111\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.53\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.7\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/72bbd7c815ef92399b7b109977ae4669ce22ee6e","https://git.kernel.org/stable/c/932a87444107e6724d808082676bba5c915c98ad","https://git.kernel.org/stable/c/a641201a9b4d69ee8a7ef35f7aa597dddee6b9ee","https://git.kernel.org/stable/c/3dd1b41f96aad08444be1b7626c89de2b9f2abd4"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-98392","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-98392","identifiers":["CVE-2026-98392"]},"retained":false,"historicalAffected":[]}],"coverage":[]}