CVE-2026-46186: Bluetooth: virtio_bt: validate rx pkt_type header length
Bluetooth: virtiobt: validate rx pkttype header length
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.141.1-1
Event History
Frequently Asked Questions
What input is needed to trigger the vulnerable receive path?
The virtio Bluetooth backend must supply a received buffer containing a packet-type byte but too little remaining data for that packet type's fixed HCI header. A one-byte completion can reach the HCI core after the packet-type byte is removed.
Are only ACL packets affected?
No. The driver accepted multiple event, ACL, SCO, and ISO packet types without verifying that the remaining buffer covered the applicable fixed HCI header. The described uninitialized-data read occurs on the ACL classification path when the HCI device has an active CIS_LINK, BIS_LINK, or PA_LINK connection.
What does the fix change?
After stripping the packet-type byte, the driver verifies that the remaining packet length is at least the fixed header size required for the selected packet type before passing the frame to the HCI core.