Executive brief
The Linux kernel's Bluetooth virtio transport driver fails to validate the length of responses from a Zephyr device's build information query, allowing a malicious backend to leak sensitive adjacent kernel memory into system logs and debug files. An attacker with control over a virtual Bluetooth device could exploit this to expose kernel data without any authentication.
Technical details
The vulnerability is an out-of-bounds (OOB) read in the virtbt_setup_zephyr() function in drivers/bluetooth/virtio_bt.c. The code sends a Zephyr vendor command (0xfc08) to read build information and passes the response directly to kernel logging and firmware-info functions as an unbounded string without checking the socket buffer (skb) length. If a backend responds with status only, the code reads past the end of the received data until it encounters a null terminator, exposing adjacent slab memory. The fix bounds the string print using "%.*s" format specifier limited to skb->len - 1. This is a network-reachable vulnerability requiring a malicious or compromised Bluetooth backend; no user interaction is needed.
Affected products
- Linux Linux kernel All versions with virtio_bt support (introduced in afd2daa26c7a)
Timeline
- 2026-09-17: disclosed
- 2026-08-07: patched: Upstream fix committed
- 2026-09-14: patched: Stable tree fix committed