CVE-2026-46140
Bluetooth: btmtk USB HCI WMT Event Length Validation Flaw
Publication date: 2026-05-28
Last updated on: 2026-05-28
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux_kernel | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's Bluetooth component, specifically in the btmtk driver. The function btmtk_usb_hci_wmt_sync() improperly casts the WMT event response SKB data to certain structures without first verifying that the SKB contains enough data. This lack of validation can lead to out-of-bounds reads when the firmware response is shorter than expected.
The issue arises because the code assumes the SKB data length is sufficient for the structures it casts to, but if the data is shorter, it reads beyond the buffer's boundary, potentially causing memory access errors.
How can this vulnerability impact me? :
This vulnerability can cause out-of-bounds memory reads in the Linux kernel Bluetooth driver, which may lead to system instability, crashes, or potentially expose sensitive kernel memory contents.
While the description does not specify exploitation details, out-of-bounds reads can sometimes be leveraged by attackers to gain information about kernel memory layout or cause denial of service.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability has been resolved by validating the WMT event SKB length before struct access in the Linux kernel Bluetooth btmtk driver.
To mitigate this vulnerability immediately, update your Linux kernel to a version that includes the fix where skb_pull_data() is used to validate and advance past the base WMT event header, ensuring that the SKB contains enough data before accessing it.