CVE-2026-46332: greybus: gb-beagleplay: bound bootloader receive buffering
In the Linux kernel, the following vulnerability has been resolved:
greybus: gb-beagleplay: bound bootloader receive buffering
cc1352bootloaderrx() appends each serdev chunk into the fixed rxbuffer before parsing bootloader packets. The helper can keep leftover bytes between callbacks and may receive multiple packets in one callback, so a single count value is not constrained by one packet length.
Check that the incoming chunk fits in the remaining receive buffer space before memcpy(). If it does not, drop the staged data and consume the bytes instead of overflowing rxbuffer.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46332?
CVE-2026-46332 has a risk rating of 44.
What types of systems are affected by CVE-2026-46332?
CVE-2026-46332 affects the Linux kernel specifically through the greybus implementation for the BeaglePlay platform.
How do I fix CVE-2026-46332?
To fix CVE-2026-46332, update to the patched version of the Linux kernel provided in the official repository.
What are the potential impacts of CVE-2026-46332?
CVE-2026-46332 may lead to data corruption or unexpected behavior during bootloader packet processing.
When was CVE-2026-46332 first published?
CVE-2026-46332 was published on June 9, 2026.