Bluetooth: btintel_pcie: fix tx_handle bounds off-by-one
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.12.111, 6.18.53, 7.2.7
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel_pcie: fix tx_handle bounds off-by-one Valid indices into txq->urbd0s/tfds/bufs are 0..txq->count-1, so tfd_index == txq->count is already out of range. Change the guard in btintel_pcie_msix_tx_handle() from '> txq->count' to '>= txq->count'. This issue was reported by Claude Mythos.
Timeline
- CVE published
- Record last updated
Affected versions
- Linux Linux
From c2b636b3f788d10486a6691ad6dd3ec4c93bd78e · fixed in 72bbd7c815ef92399b7b109977ae4669ce22ee6e; From c2b636b3f788d10486a6691ad6dd3ec4c93bd78e · fixed in 932a87444107e6724d808082676bba5c915c98ad; From c2b636b3f788d10486a6691ad6dd3ec4c93bd78e · fixed in a641201a9b4d69ee8a7ef35f7aa597dddee6b9ee; From c2b636b3f788d10486a6691ad6dd3ec4c93bd78e · fixed in 3dd1b41f96aad08444be1b7626c89de2b9f2abd4
- Linux Linux
6.10
- KernelLinux
From 6.10.0 · fixed in 6.12.111; From 6.13.0 · fixed in 6.18.53; From 6.19.0 · fixed in 7.2.7