Executive brief
A vulnerability in the Linux kernel's Bluetooth driver for virtualized environments could allow a malicious or malfunctioning virtual machine host to access sensitive information from the guest system's memory. The issue occurs when the system processes incoming Bluetooth data without properly verifying its size, potentially leading to the exposure of uninitialized data from the system's memory pool. This could result in the leakage of private information or contribute to further system instability.
Technical details
A vulnerability exists in the virtbt_rx_work() function of the virtio_bt driver where the 'len' parameter from virtqueue_get_buf() is used in skb_put() without validation against the actual buffer size (1000 bytes). Because alloc_skb() may provide more tailroom than requested, a malicious backend can specify a length larger than the data actually written, causing the kernel to process uninitialized heap memory as valid Bluetooth packets. Additionally, a length of zero is not rejected, leading to an out-of-bounds read of the pkt_type byte from uninitialized memory in virtbt_rx_handle(). The fix introduces VIRTBT_RX_BUF_SIZE to enforce strict bounds checking on all incoming virtio buffers.
Affected products
- Linux Linux kernel virtio_bt driver
Timeline
- 2026-04-21: other: Patch authored
- 2026-05-28: disclosed: CVE published
- 2026-05-06: patched: Initial patch committed to mainline
References
- https://git.kernel.org/stable/c/21bd244b6de5d2fe1063c23acc93fbdd2b20d112
- https://git.kernel.org/stable/c/6c1730099a6fc18b183bd6c1adad3b54adcaeda9
- https://git.kernel.org/stable/c/b40cdd1b1370d76e9e760af4490cb4a351cceead
- https://git.kernel.org/stable/c/e6b4296f170d949ebba937cf6a3f247ec9550d2c
- https://git.kernel.org/stable/c/ed41c81d30b211a671667259c3b5feeba0e062d5