PT-2026-44309 · Linux · Linux Kernel
CVE-2026-46186
·
Published
2026-05-28
·
Updated
2026-07-31
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
The
virtbt rx handle() function in the Bluetooth virtio bt driver fails to validate that the remaining payload length is sufficient to cover the fixed HCI header for the selected packet type after reading the leading pkt type byte. If a one-byte completion is received and identified as HCI ACLDATA PKT, the hci dev classify pkt type() function may dereference hci acl hdr(skb)->handle when the device has an active CIS LINK, BIS LINK, or PA LINK connection, leading to the reading of uninitialized RX-buffer data. This issue affects all packet types accepted by the driver because the switch cases in virtbt rx handle() do not check skb->len against the minimum HCI header size (event 2, ACL 4, SCO 3, ISO 4) before passing the frame to the core.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Use of Uninitialized Resource
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Linux Kernel