Executive brief
A vulnerability was identified in the Linux kernel's Bluetooth driver for MediaTek devices. The software fails to properly check the size of data received from the device hardware before processing it. This could allow a malfunctioning or malicious hardware component to cause a system crash or potentially leak small amounts of sensitive kernel memory.
Technical details
An out-of-bounds read vulnerability exists in the btmtk_usb_hci_wmt_sync() function within drivers/bluetooth/btmtk.c. The driver casts WMT event response socket buffers (SKB) to internal structures (btmtk_hci_wmt_evt and btmtk_hci_wmt_evt_funcc) without verifying that the buffer contains sufficient data (7 or 9 bytes respectively). A short response from the firmware or a malicious device can trigger a read beyond the buffer's tailroom. This can lead to a kernel oops (denial of service) or information disclosure of adjacent kernel memory. The fix introduces skb_pull_data() calls to validate and advance the buffer pointer safely.
Affected products
- Linux Linux Kernel All versions prior to the May 2026 patches
Timeline
- 2026-04-21: other: Vulnerability reported by Tristan Madani
- 2026-05-14: patched: Patches committed to stable kernel branches
- 2026-05-28: advisory: CVE-2026-46140 published