Executive brief
A vulnerability in the Linux kernel's Bluetooth driver for virtualized environments could allow an untrusted backend to trigger an information leak. The issue occurs when the system processes malformed Bluetooth packets that are too short to contain valid header information. This could lead to the disclosure of small amounts of uninitialized kernel memory or cause minor system instability.
Technical details
A vulnerability exists in the virtbt_rx_handle() function of the virtio_bt driver in the Linux kernel. The driver reads the pkt_type byte from an incoming socket buffer (skb) and forwards the remaining payload to hci_recv_frame() without verifying that the payload meets the minimum required length for the specific HCI packet type (Event, ACL, SCO, or ISO). An untrusted backend can provide a single-byte packet that causes hci_dev_classify_pkt_type() to dereference headers beyond the actual data length, resulting in a 2-byte read of uninitialized RX-buffer data. This has been fixed by requiring skb->len to meet the fixed header size for the selected packet type before processing.
Affected products
- Linux Linux kernel virtio_bt driver
Timeline
- 2026-05-28: disclosed: Initial publication of the vulnerability details.
- 2026-05-28: patched: Patches merged into various stable kernel branches.
References
- https://git.kernel.org/stable/c/1e1e509b6fd2a42421745bbcd98bd16daad20904
- https://git.kernel.org/stable/c/2c1143564c71e7497b42d8360a8379ccbb011d3c
- https://git.kernel.org/stable/c/3485c7236c59c8c34a41af1c4b52982437554e79
- https://git.kernel.org/stable/c/daf23014e5d975e72ea9c02b5160d3fcf070ea47
- https://git.kernel.org/stable/c/f743eab6486965f276c7e3f1700895f014fdc6db