Executive brief
The Linux kernel's Bluetooth MSFT handler fails to validate the declared length of event prefix data in controller responses. An attacker controlling a Bluetooth device could trigger the kernel to read uninitialized memory beyond the response boundary, potentially exposing sensitive kernel data or enabling a denial of service through unexpected behavior.
Technical details
The vulnerability exists in the read_supported_features() function, which validates that a Bluetooth controller response contains at least the fixed 11-byte structure, but does not validate that the response length is sufficient for the evt_prefix_len field (an unvalidated u8). This allows kmemdup() to copy up to 255 bytes from a response that may contain zero prefix bytes, reading uninitialized or attacker-controlled memory from the SKB allocation. While KASAN does not report this as out-of-bounds due to SKB allocation slack, it represents a read of bytes the host never received, with the length fully controlled by the Bluetooth controller. The fix validates that the response is long enough to contain the declared prefix before copying. The attack requires a local or proximate Bluetooth device capable of responding to MSFT feature queries.
Affected products
- Linux Linux kernel affected versions not specified in advisory
Timeline
- 2026-09-17: disclosed