CVE-2026-46138: Bluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt

Q: What does an attacker need to exploit this issue?

An attacker needs to send a crafted LE_Create_BIG_Complete Bluetooth controller event with fewer BIS handles than BT_BOUND connections associated with the BIG, including an event with num_bis set to zero. The CVSS vector indicates adjacent-network access, no privileges, and no user interaction are required.

Q: What is the likely impact if exploitation succeeds?

The vulnerable handler can read beyond the valid bis_handle array into adjacent heap memory. Invalid values can leave a connection in BT_BOUND state and cause an infinite loop while the Bluetooth device lock is held, resulting in a high availability impact; the CVSS vector also rates confidentiality impact as high.

Q: How can I tell whether a system is affected during an attack?

A relevant symptom is the Bluetooth handler entering an infinite loop while hci_dev_lock is held after processing a LE_Create_BIG_Complete event. This occurs when not all BIS connections can be set up and a BT_BOUND connection continues to be found for the same BIG.

Q: What mitigation is described if all BIS connections cannot be set up?

The fix terminates the BIG when all BIS connections cannot be set up properly. Applying a kernel version containing the referenced stable fixes addresses both the out-of-bounds array access and the repeated BT_BOUND connection lookup.

Published May 28, 2026

Updated

Bluetooth: hcievent: Fix OOB read and infinite loop in hcilecreatebigcompleteevt

Affected Software

9 affected componentsFixes available

Linux Linux kernel

Linux Linux kernel>=6.4.16<6.5

Linux Linux kernel>=6.5.3<6.6.140

Linux Linux kernel>=6.7<6.12.88

Linux Linux kernel>=6.13<6.18.30

Linux Linux kernel>=6.19<7.0.7

Linux Linux kernel=7.1-rc1

Linux Linux kernel=7.1-rc2

Microsoft azl3 kernel 6.6.139.1-1<6.6.141.1-1

6.6.141.1-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.141.1-1
Compensating control
Terminate the BIG when fewer BIS could be setup than expected (i.e., ensure the BIG is rejected/terminated instead of continuing with out-of-bounds access when not all BIS are present).
Operational
After applying the kernel fix, verify that the created BIG no longer enters an infinite loop (e.g., ensure the event handling completes and the connection state does not remain in BT_BOUND due to repeated lookups).

Event History

May 28, 2026

CVE Published

via MITRE·09:35 AM

Data Sourced

via MITRE·09:35 AM

DescriptionSeverity

Data Sourced

via NVD·10:16 AM

RemedyDescriptionSeverityWeaknessAffected Software

May 29, 2026

Data Sourced

via Microsoft·08:07 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What does an attacker need to exploit this issue?

An attacker needs to send a crafted LE_Create_BIG_Complete Bluetooth controller event with fewer BIS handles than BT_BOUND connections associated with the BIG, including an event with num_bis set to zero. The CVSS vector indicates adjacent-network access, no privileges, and no user interaction are required.

What is the likely impact if exploitation succeeds?

The vulnerable handler can read beyond the valid bis_handle array into adjacent heap memory. Invalid values can leave a connection in BT_BOUND state and cause an infinite loop while the Bluetooth device lock is held, resulting in a high availability impact; the CVSS vector also rates confidentiality impact as high.

How can I tell whether a system is affected during an attack?

A relevant symptom is the Bluetooth handler entering an infinite loop while hci_dev_lock is held after processing a LE_Create_BIG_Complete event. This occurs when not all BIS connections can be set up and a BT_BOUND connection continues to be found for the same BIG.

What mitigation is described if all BIS connections cannot be set up?

The fix terminates the BIG when all BIS connections cannot be set up properly. Applying a kernel version containing the referenced stable fixes addresses both the out-of-bounds array access and the repeated BT_BOUND connection lookup.

CVE-2026-46138: Bluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt

Affected Software

Remediation

Event History

Frequently Asked Questions

What does an attacker need to exploit this issue?

What is the likely impact if exploitation succeeds?

How can I tell whether a system is affected during an attack?

What mitigation is described if all BIS connections cannot be set up?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

What is the likely impact if exploitation succeeds?

How can I tell whether a system is affected during an attack?

What mitigation is described if all BIS connections cannot be set up?