UBUNTU-CVE-2026-90090: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btmtksdio: Fix out-of-bounds DMA read in the TX path btmtksdiotxpacket() rounds the transfer size up to the SDIO block size of 256 bytes, but hands the host controller the SKB buffer as is: err = sdiowritesb(bdev->func, MTKREGCTDR, skb->data, roundup(skb->len, MTKSDIOBLOCKSIZE)); Only skb->len bytes hold packet data, so the controller reads up to 255 bytes of uninitialised memory and sends it to the device over the SDIO bus. Depending on how much tailroom slack the SKB allocation happens to carry, that read can also extend past the end of the buffer. Compute the padded length up front, ensure the SKB has tailroom for it, and zero-fill the padding with skbputzero(). skb->len then covers the padding, so sdiowritesb() no longer needs to round up. bytetx keeps counting the header and the payload only, and the error path restores the SKB so that the caller can requeue it. Writing behind skb->tail is only safe because the driver owns the buffer, which "Bluetooth: btmtksdio: Take exclusive ownership of the SKB before TX" ensures.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In btmtksdio_tx_packet(), compute the padded transfer length up front, ensure the SKB has tailroom for the padding, and zero-fill the padding with skb_put_zero(); then use the resulting skb->len for sdio_writesb() without rounding it again. Ensure the driver has exclusive SKB ownership before writing beyond skb->tail.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using an affected Ubuntu kernel package and the MediaTek Bluetooth SDIO driver (btmtksdio) are relevant. Exploitation requires local access with low privileges; no user interaction is required.
What does an attacker need to trigger the flaw?
The issue occurs in the Bluetooth transmit path when the driver sends a packet whose length is rounded up to the 256-byte SDIO block size. The available data does not identify a remote attack path or a required Bluetooth pairing state.
What is the impact of a successful trigger?
The SDIO controller can read up to 255 bytes of uninitialized memory beyond the packet data and send those bytes to the Bluetooth device. Depending on SKB tailroom, the DMA read may also extend beyond the end of the allocated buffer; the provided severity vector indicates availability impact but no assessed confidentiality or integrity impact.
What does the fix change?
The fix ensures the transmit buffer has enough tailroom for block-size padding, zero-fills that padding, and includes it in the buffer length before transmission. This prevents the controller from reading uninitialized memory or reading past the buffer during the padded SDIO transfer.