In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: virtio_bt: validate rx pkt_type header length
virtbt_rx_handle() reads the leading pkt_type byte from the RX skb
and forwards the remainder to hci_recv_frame() for every
event/ACL/SCO/ISO type, without checking that the remaining payload
is at least the fixed HCI header for that type.
After the preceding patch bounds the backend-supplied used.len to
[1, VIRTBT_RX_BUF_SIZE], a one-byte completion still reaches
hci_recv_frame() with skb->len already pulled to 0. If the byte
happened to be HCI_ACLDATA_PKT, the ACL-vs-ISO classification
fast-path in hci_dev_classify_pkt_type() dereferences
hci_acl_hdr(skb)->handle whenever the HCI device has an active
CIS_LINK, BIS_LINK, or PA_LINK connection, reading two bytes of
uninitialized RX-buffer data. The same hazard exists for every
packet type the driver accepts because none of the switch cases in
virtbt_rx_handle() check skb->len against the per-type minimum HCI
header size before handing the frame to the core.
After stripping pkt_type, require skb->len to cover the fixed
header size for the selected type (event 2, ACL 4, SCO 3, ISO 4)
before calling hci_recv_frame(); drop ratelimited otherwise.
Unknown pkt_type values still take the original kfree_skb() default
path.
Use bt_dev_err_ratelimited() because both the length and pkt_type
values come from an untrusted backend that can otherwise flood the
kernel log.
References
Configurations
Configuration 1 (hide)
|
History
11 Jun 2026, 03:06
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-908 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.5 |
| First Time |
Linux linux Kernel
Linux |
|
| References | () https://git.kernel.org/stable/c/149cfb42ad69c7964fd9f2c43831da9152007129 - Patch | |
| References | () https://git.kernel.org/stable/c/1e1e509b6fd2a42421745bbcd98bd16daad20904 - Patch | |
| References | () https://git.kernel.org/stable/c/2c1143564c71e7497b42d8360a8379ccbb011d3c - Patch | |
| References | () https://git.kernel.org/stable/c/3485c7236c59c8c34a41af1c4b52982437554e79 - Patch | |
| References | () https://git.kernel.org/stable/c/7b2d4c04816cdc887f472caaf7fc966cfc107e40 - Patch | |
| References | () https://git.kernel.org/stable/c/daf23014e5d975e72ea9c02b5160d3fcf070ea47 - Patch | |
| References | () https://git.kernel.org/stable/c/f743eab6486965f276c7e3f1700895f014fdc6db - Patch | |
| CPE | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.1:rc4:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.1:rc6:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.1:rc8:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.1:rc7:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.1:rc5:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.1:-:*:*:*:*:*:* |
01 Jun 2026, 17:17
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
28 May 2026, 10:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-05-28 10:16
Updated : 2026-06-11 03:06
NVD link : CVE-2026-46186
Mitre link : CVE-2026-46186
CVE.ORG link : CVE-2026-46186
JSON object : View
Products Affected
linux
- linux_kernel
CWE
CWE-908
Use of Uninitialized Resource