CVE-2026-90090: Bluetooth: btmtksdio: Fix out-of-bounds DMA read in the TX path
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: btmtksdio: Fix out-of-bounds DMA read in the TX path
btmtksdiotxpacket() rounds the transfer size up to the SDIO block size of 256 bytes, but hands the host controller the SKB buffer as is:
err = sdiowritesb(bdev->func, MTKREGCTDR, skb->data, roundup(skb->len, MTKSDIOBLOCKSIZE));
Only skb->len bytes hold packet data, so the controller reads up to 255 bytes of uninitialised memory and sends it to the device over the SDIO bus. Depending on how much tailroom slack the SKB allocation happens to carry, that read can also extend past the end of the buffer.
Compute the padded length up front, ensure the SKB has tailroom for it, and zero-fill the padding with skbputzero(). skb->len then covers the padding, so sdiowritesb() no longer needs to round up. bytetx keeps counting the header and the payload only, and the error path restores the SKB so that the caller can requeue it.
Writing behind skb->tail is only safe because the driver owns the buffer, which "Bluetooth: btmtksdio: Take exclusive ownership of the SKB before TX" ensures.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.188 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.157 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.110 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.52 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.6 - Compensating control
In btmtksdio_tx_packet(), compute the transfer length rounded to the 256-byte SDIO block size, ensure the SKB has tailroom for the padding, take exclusive ownership of the SKB before TX, and zero-fill the padding with skb_put_zero(). Keep byte_tx limited to the header and payload, restore the SKB on the error path so the caller can requeue it, and pass skb->len to sdio_writesb() without rounding it again.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel's btmtksdio Bluetooth driver are exposed when it transmits packets over an SDIO-connected MediaTek Bluetooth device. The issue occurs in the driver's TX path during SDIO block-size padding.
What information could be affected during exploitation?
The driver can send up to 255 bytes beyond the packet's valid data to the Bluetooth device over the SDIO bus. Those bytes may be uninitialized memory and, where available tailroom is insufficient, the DMA read can extend beyond the end of the SKB buffer.
What should be done if an update cannot be applied immediately?
The provided data does not identify a configuration workaround. Reducing or disabling use of the affected btmtksdio Bluetooth hardware/driver would avoid triggering its transmit path.
How does the fix prevent the out-of-bounds read?
The fix calculates the padded transfer length before transmission, ensures the SKB has sufficient tailroom, and zero-fills the padding. It then transmits the expanded SKB length rather than asking the SDIO controller to round up a shorter buffer.