Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2026-46186

Bluetooth: virtio_bt: validate rx pkt_type header length

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: virtio_bt: validate rx pkt_type header length virtbt_rx_handle() reads the leading pkt_type byte from the RX skb and forwards the remainder to hci_recv_frame() for every event/ACL/SCO/ISO type, without checking that the remaining payload is at least the fixed HCI header for that type. After the preceding patch bounds the backend-supplied used.len to [1, VIRTBT_RX_BUF_SIZE], a one-byte completion still reaches hci_recv_frame() with skb->len already pulled to 0. If the byte happened to be HCI_ACLDATA_PKT, the ACL-vs-ISO classification fast-path in hci_dev_classify_pkt_type() dereferences hci_acl_hdr(skb)->handle whenever the HCI device has an active CIS_LINK, BIS_LINK, or PA_LINK connection, reading two bytes of uninitialized RX-buffer data. The same hazard exists for every packet type the driver accepts because none of the switch cases in virtbt_rx_handle() check skb->len against the per-type minimum HCI header size before handing the frame to the core. After stripping pkt_type, require skb->len to cover the fixed header size for the selected type (event 2, ACL 4, SCO 3, ISO 4) before calling hci_recv_frame(); drop ratelimited otherwise. Unknown pkt_type values still take the original kfree_skb() default path. Use bt_dev_err_ratelimited() because both the length and pkt_type values come from an untrusted backend that can otherwise flood the kernel log.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • cf2719a21fdb9d4c8e9c834d279163609bef575d to < 149cfb42ad69c7964fd9f2c43831da9152007129affected
  • 160fbcf3bfb93c3c086427f9f4c8bc70f217e9be to < 7b2d4c04816cdc887f472caaf7fc966cfc107e40affected
  • 160fbcf3bfb93c3c086427f9f4c8bc70f217e9be to < 1e1e509b6fd2a42421745bbcd98bd16daad20904affected
  • 160fbcf3bfb93c3c086427f9f4c8bc70f217e9be to < 2c1143564c71e7497b42d8360a8379ccbb011d3caffected
  • 160fbcf3bfb93c3c086427f9f4c8bc70f217e9be to < 3485c7236c59c8c34a41af1c4b52982437554e79affected
  • 160fbcf3bfb93c3c086427f9f4c8bc70f217e9be to < f743eab6486965f276c7e3f1700895f014fdc6dbaffected
  • 160fbcf3bfb93c3c086427f9f4c8bc70f217e9be to < daf23014e5d975e72ea9c02b5160d3fcf070ea47affected
  • 9b67438e315b925a699f0178f4a48baf3d2d6ef4affected
  • 5.15.78 to < 5.15.209affected
  • 6.0.8 to < 6.1affected

Linux Linux

Default version status: affected

  • 6.1affected
  • 0 to < 6.1unaffected
  • 5.15.209 to ≤ 5.15.*unaffected
  • 6.1.175 to ≤ 6.1.*unaffected
  • 6.6.140 to ≤ 6.6.*unaffected
  • 6.12.88 to ≤ 6.12.*unaffected
  • 6.18.30 to ≤ 6.18.*unaffected
  • 7.0.7 to ≤ 7.0.*unaffected
  • 7.1 to ≤ *unaffected

References