CVE-2026-90089: Bluetooth: btnxpuart: Validate the FW dump header length
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: btnxpuart: Validate the FW dump header length
nxpprocessfwdump() pulls the ACL header off the frame and then reads seqnum and buflen from a struct nxpfwdumphdr placed at skb->data, without checking that the ACL payload is long enough to contain it.
h4recvbuf() collects HCIACLHDRSIZE bytes of header followed by the number of payload bytes named in that header, so skb->len is 4 + dlen with dlen supplied by the controller and possibly smaller than the 8 byte dump header, or zero. A short frame with connection handle 0xfff therefore reads both fields from beyond the received data.
Beyond the read itself, buflen is what terminates a dump: a value of zero makes the driver call hcidevcdcomplete() and reset the controller, so a truncated frame can end a dump early.
Use skbpulldata() to validate and pull the FW dump header before accessing its fields. Warn and reject the chunk if the header is truncated.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel's btnxpuart Bluetooth driver are exposed when the driver processes firmware-dump traffic from its Bluetooth controller.
What does an attacker or faulty device need to send to trigger the flaw?
The Bluetooth controller must provide a short ACL frame with connection handle 0xfff whose declared payload is smaller than the 8-byte firmware-dump header, including a zero-length payload.
What does the available fix do?
The fix validates and pulls the firmware-dump header with skb_pull_data() before reading its fields. Truncated chunks are warned about and rejected rather than being processed.