{"apiVersion":"1.0","identifier":"CVE-2026-99094","description":"In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel_pcie: fix TX descriptor bounds check btintel_pcie_prepare_tx() uses tfd_index to access the TFD and data buffer arrays before the index is advanced modulo txq->count. An index equal to txq->count is one past the end of both arrays, so reject it in the bounds check.","publishedAt":"2026-10-26T15:16:48","lastModifiedAt":"2026-10-31T13:17:54","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-99094","cvssScore":7.5,"cvssVector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","epssProbability":0.00226,"riskScore":0.77,"affectedProduct":"Linux kernel","affectedVersions":"unknown","vulnerabilityType":"Kernel","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-99094","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-99094","en":"https://www.redsauce.net/en/cves/CVE-2026-99094","fr":"https://www.redsauce.net/fr/cves/CVE-2026-99094","pt":"https://www.redsauce.net/pt/cves/CVE-2026-99094","de":"https://www.redsauce.net/de/cves/CVE-2026-99094","sk":"https://www.redsauce.net/sk/cves/CVE-2026-99094","el":"https://www.redsauce.net/el/cves/CVE-2026-99094"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-99094"}}