PT-2026-44261 · Linux · Linux Kernel
Published
2026-05-28
·
Updated
2026-06-04
·
CVE-2026-46138
CVSS v3.1
8.1
High
| Vector | AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
An out-of-bounds read and infinite loop exist in the
hci le create big complete evt() function. The function iterates over BT BOUND connections for a BIG handle using a while loop that accesses the ev->bis handle[i++] array without verifying if i remains within the ev->num bis limit. If a controller sends an LE Create BIG Complete event where num bis is 0 or contains fewer entries than there are BT BOUND connections, the system reads adjacent heap memory. Because these out-of-bounds values usually exceed HCI CONN HANDLE MAX, the hci conn set handle() function rejects them, leaving the connection in a BT BOUND state. This causes the connection to be repeatedly found by hci conn hash lookup big state(), resulting in an infinite loop while the hci dev lock is held.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux Kernel