GIVE YOUR AGENT THE EVIDENCE

Set up in your agent.

One prompt to get started. Paste it into your coding agent to connect cve.new through MCP and bring vulnerability context into your workflow.

Your agent needs remote MCP support and access to https://cve.new/mcp.

Read the setup guide

GIVE YOUR AGENT THE EVIDENCE

Investigate in your agent.

Turn this advisory into a focused investigation. Ask your agent to check your project’s versions, explain the evidence, and suggest a compatible fix.

Your agent needs remote MCP support and access to https://cve.new/mcp.

Read the setup guide

cve.new
Check your stack
CVE-2026-99094unknown

Bluetooth: btintel_pcie: fix TX descriptor bounds check

Impact

In the Linux kernel, the following vulnerability has been resolved:

Source excerpt · Linux

Affected packages

This source has no supported package-version data for matching. You can read the advisory here, but this record alone cannot power a dependency check.

Affected products

Vendor version evidence. Product records are separate from automatic dependency matching.

Linux · Linux

Other versions: unaffected

Version / rangeSource status
6e65a09f927566f257322358d429b267548473eb to before 08704ec6d4bf69725e7815b09a9b5c7af83e255baffected
6e65a09f927566f257322358d429b267548473eb to before 39ab048cce70d50af48015f5f294c4cf80d6ba89affected
6e65a09f927566f257322358d429b267548473eb to before 2669567615215d52fb306053cbcc1f53dc386158affected
6e65a09f927566f257322358d429b267548473eb to before baa53af641c9e3644e717b8dfd1b95a55a0c111baffected
Linux version evidence

Linux · Linux

Other versions: affected

Version / rangeSource status
6.10affected
0 to before 6.10unaffected
6.12.113 through 6.12.* (inclusive)unaffected
6.18.57 through 6.18.* (inclusive)unaffected
7.2.11 through 7.2.* (inclusive)unaffected
7.3 through * (inclusive)unaffected
Linux version evidence

Original source description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btintel_pcie: fix TX descriptor bounds check

btintel_pcie_prepare_tx() uses tfd_index to access the TFD and data buffer arrays before the index is advanced modulo txq->count. An index equal to txq->count is one past the end of both arrays, so reject it in the bounds check.

References