Medium 5.5Published May 28, 2026

CVE-2026-46186Bluetooth: virtio_bt: validate rx pkt_type header length

Updated under an hour ago (Oct 27, 2026, 2:40 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: virtio_bt: validate rx pkt_type header length virtbt_rx_handle() reads the leading pkt_type byte from the RX skb and forwards the remainder to hci_recv_frame() for every event/ACL/SCO/ISO type, without checking that the remaining payload is at least the fixed HCI header for that type. After the preceding patch bounds the backend-supplied used.len to [1, VIRTBT_RX_BUF_SIZE], a one-byte completion still reaches hci_recv_frame() with skb->len already pulled to 0. If the byte happened to be HCI_ACLDATA_PKT, the ACL-vs-ISO classification fast-path in hci_dev_classify_pkt_type() dereferences hci_acl_hdr(skb)->handle whenever the HCI device has an active CIS_LINK, BIS_LINK, or PA_LINK connection, reading two bytes of uninitialized RX-buffer data. The same hazard exists for every packet type the driver accepts because none of the switch cases in virtbt_rx_handle() check skb->len against the per-type minimum HCI header size before handing the frame to the core. After stripping pkt_type, require skb->len to cover the fixed header size for the selected type (event 2, ACL 4, SCO 3, ISO 4) before calling hci_recv_frame(); drop ratelimited otherwise. Unknown pkt_type values still take the original kfree_skb() default path. Use bt_dev_err_ratelimited() because both the length and pkt_type values come from an untrusted backend that can otherwise flood the kernel log.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: Jun 14, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from cf2719a21fdb9d4c8e9c834d279163609bef575d before 149cfb42ad69c7964fd9f2c43831da9152007129; 160fbcf3bfb93c3c086427f9f4c8bc70f217e9be builds before 7b2d4c04816cdc887f472caaf7fc966cfc107e40; 160fbcf3bfb93c3c086427f9f4c8bc70f217e9be builds before 1e1e509b6fd2a42421745bbcd98bd16daad20904; 160fbcf3bfb93c3c086427f9f4c8bc70f217e9be builds before 2c1143564c71e7497b42d8360a8379ccbb011d3c; from 160fbcf3bfb93c3c086427f9f4c8bc70f217e9be before 3485c7236c59c8c34a41af1c4b52982437554e79; from 160fbcf3bfb93c3c086427f9f4c8bc70f217e9be before f743eab6486965f276c7e3f1700895f014fdc6db; from 160fbcf3bfb93c3c086427f9f4c8bc70f217e9be before daf23014e5d975e72ea9c02b5160d3fcf070ea47; 9b67438e315b925a699f0178f4a48baf3d2d6ef4; and 2 more ranges	CNA record
linux linux_kernel linux:linux_kernel	from 5.15.78 before 5.15.209; from 6.0.8 before 6.1; from 6.1.1 before 6.1.175; from 6.2 before 6.6.140; from 6.7 before 6.12.88; from 6.13 before 6.18.30; from 6.19 before 7.0.7; 6.1; and 7 more ranges	NVD

References

References

https://git.kernel.org/stable/c/149cfb42ad69c7964fd9f2c43831da9152007129	patch
https://git.kernel.org/stable/c/7b2d4c04816cdc887f472caaf7fc966cfc107e40	patch
https://git.kernel.org/stable/c/1e1e509b6fd2a42421745bbcd98bd16daad20904	patch
https://git.kernel.org/stable/c/2c1143564c71e7497b42d8360a8379ccbb011d3c	patch
https://git.kernel.org/stable/c/3485c7236c59c8c34a41af1c4b52982437554e79	patch
https://git.kernel.org/stable/c/f743eab6486965f276c7e3f1700895f014fdc6db	patch
https://git.kernel.org/stable/c/daf23014e5d975e72ea9c02b5160d3fcf070ea47	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.