Bluetooth: virtio_bt: validate rx pkt_type header length

MITRE NVD CVE.ORG JSON API Print: PDF PDF

Summary

CVECVE-2026-46186
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-05-28 10:16:34 UTC
Updated2026-06-11 03:06:40 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: Bluetooth: virtio_bt: validate rx pkt_type header length virtbt_rx_handle() reads the leading pkt_type byte from the RX skb and forwards the remainder to hci_recv_frame() for every event/ACL/SCO/ISO type, without checking that the remaining payload is at least the fixed HCI header for that type. After the preceding patch bounds the backend-supplied used.len to [1, VIRTBT_RX_BUF_SIZE], a one-byte completion still reaches hci_recv_frame() with skb->len already pulled to 0. If the byte happened to be HCI_ACLDATA_PKT, the ACL-vs-ISO classification fast-path in hci_dev_classify_pkt_type() dereferences hci_acl_hdr(skb)->handle whenever the HCI device has an active CIS_LINK, BIS_LINK, or PA_LINK connection, reading two bytes of uninitialized RX-buffer data. The same hazard exists for every packet type the driver accepts because none of the switch cases in virtbt_rx_handle() check skb->len against the per-type minimum HCI header size before handing the frame to the core. After stripping pkt_type, require skb->len to cover the fixed header size for the selected type (event 2, ACL 4, SCO 3, ISO 4) before calling hci_recv_frame(); drop ratelimited otherwise. Unknown pkt_type values still take the original kfree_skb() default path. Use bt_dev_err_ratelimited() because both the length and pkt_type values come from an untrusted backend that can otherwise flood the kernel log.

Risk And Classification

Primary CVSS: v3.1 5.5 MEDIUM from [email protected]

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS: 0.000320000 probability, percentile 0.097350000 (date 2026-06-04)

Problem Types: CWE-908

CVSS v3.1 Breakdown

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

NVD Known Affected Configurations (CPE 2.3)

TypeVendorProductVersionUpdateEditionLanguage
Operating System Linux Linux Kernel All All All All

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected cf2719a21fdb9d4c8e9c834d279163609bef575d 149cfb42ad69c7964fd9f2c43831da9152007129 git Not specified
CNA Linux Linux affected 160fbcf3bfb93c3c086427f9f4c8bc70f217e9be 7b2d4c04816cdc887f472caaf7fc966cfc107e40 git Not specified
CNA Linux Linux affected 160fbcf3bfb93c3c086427f9f4c8bc70f217e9be 1e1e509b6fd2a42421745bbcd98bd16daad20904 git Not specified
CNA Linux Linux affected 160fbcf3bfb93c3c086427f9f4c8bc70f217e9be 2c1143564c71e7497b42d8360a8379ccbb011d3c git Not specified
CNA Linux Linux affected 160fbcf3bfb93c3c086427f9f4c8bc70f217e9be 3485c7236c59c8c34a41af1c4b52982437554e79 git Not specified
CNA Linux Linux affected 160fbcf3bfb93c3c086427f9f4c8bc70f217e9be f743eab6486965f276c7e3f1700895f014fdc6db git Not specified
CNA Linux Linux affected 160fbcf3bfb93c3c086427f9f4c8bc70f217e9be daf23014e5d975e72ea9c02b5160d3fcf070ea47 git Not specified
CNA Linux Linux affected 9b67438e315b925a699f0178f4a48baf3d2d6ef4 git Not specified
CNA Linux Linux affected 5.15.78 5.15.209 semver Not specified
CNA Linux Linux affected 6.0.8 6.1 semver Not specified
CNA Linux Linux affected 6.1 Not specified
CNA Linux Linux unaffected 6.1 semver Not specified
CNA Linux Linux unaffected 5.15.209 5.15.* semver Not specified
CNA Linux Linux unaffected 6.1.175 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.140 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.88 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.30 6.18.* semver Not specified
CNA Linux Linux unaffected 7.0.7 7.0.* semver Not specified
CNA Linux Linux unaffected 7.1-rc3 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/3485c7236c59c8c34a41af1c4b52982437554e79 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/149cfb42ad69c7964fd9f2c43831da9152007129 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/daf23014e5d975e72ea9c02b5160d3fcf070ea47 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/2c1143564c71e7497b42d8360a8379ccbb011d3c 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/f743eab6486965f276c7e3f1700895f014fdc6db 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/7b2d4c04816cdc887f472caaf7fc966cfc107e40 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/1e1e509b6fd2a42421745bbcd98bd16daad20904 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis
© CVE.report 2026 |

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report