Executive brief
The Linux kernel's Bluetooth driver for MediaTek SDIO devices (btmtksdio) has a buffer overread vulnerability in packet transmission. When sending Bluetooth packets, the driver instructs the SDIO controller to read more data than actually exists in the packet buffer—up to 255 extra bytes of uninitialized memory—and transmit it to the device. An attacker could potentially use this information leak to access sensitive kernel memory or destabilize system operations.
Technical details
The vulnerability is an out-of-bounds DMA read in the btmtksdio_tx_packet() function. The driver rounds up the SKB (socket buffer) packet length to a 256-byte SDIO block size boundary but passes the actual unpadded buffer pointer to sdio_writesb(), causing the hardware controller to read up to 255 bytes past the packet data. Depending on SKB allocation tailroom, this read can extend beyond the buffer bounds. The attack vector is local (driver executes in kernel context), no network access required. The fix ensures the SKB has sufficient tailroom, zero-fills padding with skb_put_zero(), and updates skb->len to include padding before the DMA transfer. A patch was committed upstream and backported to stable kernel branches.
Affected products
- Linux Linux Kernel Affected versions include stable kernel branches 5.x, 6.x and potentially earlier versions with the btmtksdio driver; patch available in upstream and stable branches
Timeline
- 2026-08-17: other: Patch authored by Chris Lu
- 2026-09-14: patched: Patch committed to stable Linux kernel tree by Greg Kroah-Hartman
- 2026-09-17: disclosed: Published in NVD