CVE-2026-46123: Bluetooth: virtio_bt: clamp rx length before skb_put
Bluetooth: virtiobt: clamp rx length before skbput
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.141.1-1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using the Linux kernel virtio_bt Bluetooth driver are exposed when their virtio Bluetooth backend is malicious or buggy. The listed affected software includes the Linux kernel and Microsoft azl3 kernel 6.6.139.1-1.
What does an attacker or faulty component need to do to trigger it?
The virtio Bluetooth backend must return a crafted receive length. A length from 1001 bytes up to the skb tailroom can cause uninitialized kernel heap data to be included, while a zero length can cause uninitialized memory to be read as a packet type.
Is this reachable through normal received Bluetooth traffic alone?
The described condition depends on the length reported by virtqueue_get_buf() from the virtio Bluetooth backend, not merely on a Bluetooth packet payload. The vulnerable path is therefore tied to control of, or a defect in, that backend.
What is the relevant mitigation if the kernel cannot be updated immediately?
Avoid using an untrusted or known-buggy virtio Bluetooth backend. The fix rejects zero-length receive buffers and rejects lengths exceeding the 1000-byte buffer exposed to the device.