Executive brief
The Linux kernel's Bluetooth driver for NXP UART controllers (btnxpuart) contains a vulnerability in its firmware dump feature. A malformed firmware dump packet with a truncated or undersized header can cause the driver to read memory beyond the received data, potentially allowing a nearby Bluetooth device to trigger a denial of service by resetting the controller prematurely or causing undefined behavior.
Technical details
The vulnerability is a classic out-of-bounds read in the nxp_process_fw_dump() function. The code extracts a firmware dump header (nxp_fw_dump_hdr) from an ACL packet without validating that the packet payload is large enough to contain the full 8-byte header structure. The ACL payload length is controlled by the remote Bluetooth device. A truncated packet allows attacker-controlled reads of kernel memory beyond the skb buffer. Additionally, the buf_len field read from untrusted memory determines when the dump terminates; a malicious value can cause premature termination and controller reset. The fix adds proper bounds checking using skb_pull_data() before accessing header fields, preventing out-of-bounds access and rejecting truncated frames.
Affected products
- Linux Linux kernel affected versions prior to commit 060fa7592bdc043a93b6b7870f5b8551206d315d
Timeline
- 2026-09-17: disclosed: CVE-2026-90089 published
- 2026-08-24: patched: Patch committed upstream by Luiz Augusto von Dentz
- 2026-09-14: patched: Patch backported to stable kernels