CVE-2026-46140: Bluetooth: btmtk: validate WMT event SKB length before struct access
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: btmtk: validate WMT event SKB length before struct access
btmtkusbhciwmtsync() casts the WMT event response SKB data to struct btmtkhciwmtevt (7 bytes) and struct btmtkhciwmtevtfuncc (9 bytes) without first checking that the SKB contains enough data. A short firmware response causes out-of-bounds reads from SKB tailroom.
Use skbpulldata() to validate and advance past the base WMT event header. For the FUNCCTRL case, pull the additional status field bytes before accessing them.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46140?
CVE-2026-46140 has a severity score of 15, indicating a critical risk level.
How do I fix CVE-2026-46140?
To fix CVE-2026-46140, update your Linux kernel to the latest version where this vulnerability has been patched.
What type of vulnerability is CVE-2026-46140?
CVE-2026-46140 is a vulnerability in the Bluetooth subsystem of the Linux kernel related to improper validation of event SKB length.
Which software is affected by CVE-2026-46140?
CVE-2026-46140 affects the Linux Foundation Linux kernel, specifically within the Bluetooth btmtk module.
When was CVE-2026-46140 published?
CVE-2026-46140 was published on May 28, 2026.