CVE-2026-46123
Buffer Overflow in Linux Kernel Bluetooth VirtIO Driver
Publication date: 2026-05-28
Last updated on: 2026-05-28
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is resolved by ensuring that the length of received Bluetooth data is properly validated before processing. Immediate mitigation involves updating the Linux kernel to a version that includes the fix where the buffer length is clamped and zero-length packets are rejected.
Specifically, the fix defines a constant buffer size (VIRTBT_RX_BUF_SIZE) used consistently in buffer allocation and validation, preventing uninitialized kernel memory from being exposed.
Additionally, the kernel log flooding is mitigated by rate-limiting error messages related to this issue.
- Update your Linux kernel to the patched version released on or after 2026-05-28.
- Avoid using vulnerable kernel versions that do not include the clamp on rx length before skb_put in the virtio_bt driver.
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's Bluetooth virtio_bt driver. It occurs because the function virtbt_rx_work() calls skb_put(skb, len) with a length value (len) obtained from virtqueue_get_buf() without validating it against the actual buffer size posted to the device.
The RX skb buffer is allocated with exactly 1000 bytes exposed to the device, but the length len can be larger than 1000 bytes (up to the skb's tailroom), which can cause skb_put() to include uninitialized kernel heap bytes that were never written by the device.
Additionally, if len is zero, skb_put(skb, 0) leaves the skb empty, but virtbt_rx_handle() still reads from skb->data, consuming uninitialized memory. This can lead to the kernel processing uninitialized or potentially sensitive data.
The fix involves defining a constant buffer size and validating len against this size, rejecting zero-length completions, and logging errors in a rate-limited manner to prevent log flooding.
How can this vulnerability impact me? :
This vulnerability can lead to the Linux kernel including uninitialized kernel heap memory in Bluetooth data processing. This may cause information leakage of sensitive kernel memory contents.
A malicious or buggy backend device could exploit this to cause the kernel to expose uninitialized memory, potentially leading to data leakage or instability.
Furthermore, reading uninitialized memory can cause unpredictable behavior or crashes, impacting system stability and security.