Heimdall Security Logo

CVE-2026-46186

Vulnérabilité non évaluée dans Linux (Linux)

CVSS 0.0 · Non évaluée
EPSS 0.2%
Linux•Linux•Versions : <=6.1.*, 7.0.7, <=7.0.*, <=6.12.*, 0, 6.0.8, 9b67438e315b925a699f0178f4a48baf3d2d6ef4, <2c1143564c71e7497b42d8360a8379ccbb011d3c, 6.12.88, 5.15.209, <=6.6.*, 6.1.175, <149cfb42ad69c7964fd9f2c43831da9152007129, cf2719a21fdb9d4c8e9c834d279163609bef575d, 7.1, <=6.18.*, 5.15.78, 6.1, <7b2d4c04816cdc887f472caaf7fc966cfc107e40, <3485c7236c59c8c34a41af1c4b52982437554e79, <f743eab6486965f276c7e3f1700895f014fdc6db, <=*, <5.15.209, <=5.15.*, <1e1e509b6fd2a42421745bbcd98bd16daad20904, 160fbcf3bfb93c3c086427f9f4c8bc70f217e9be, <daf23014e5d975e72ea9c02b5160d3fcf070ea47, 6.6.140, 6.18.30, <6.1

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: virtio_bt: validate rx pkt_type header length virtbt_rx_handle() reads the leading pkt_type byte from the RX skb and forwards the remainder to hci_recv_frame() for every event/ACL/SCO/ISO type, without checking that the remaining payload is at least the fixed HCI header for that type. After the preceding patch bounds the backend-supplied used.len to [1, VIRTBT_RX_BUF_SIZE], a one-byte completion still reaches hci_recv_frame() with skb->len already pulled to 0. If the byte happened to be HCI_ACLDATA_PKT, the ACL-vs-ISO classification fast-path in hci_dev_classify_pkt_type() dereferences hci_acl_hdr(skb)->handle whenever the HCI device has an active CIS_LINK, BIS_LINK, or PA_LINK connection, reading two bytes of uninitialized RX-buffer data. The same hazard exists for every packet type the driver accepts because none of the switch cases in virtbt_rx_handle() check skb->len against the per-type minimum HCI header size before handing the frame to the core. After stripping pkt_type, require skb->len to cover the fixed header size for the selected type (event 2, ACL 4, SCO 3, ISO 4) before calling hci_recv_frame(); drop ratelimited otherwise. Unknown pkt_type values still take the original kfree_skb() default path. Use bt_dev_err_ratelimited() because both the length and pkt_type values come from an untrusted backend that can otherwise flood the kernel log.

Gravité et risque d'exploitation

CVE-2026-46186 obtient un score CVSS de 0.0/10, soit une gravité non évaluée. Selon le modèle EPSS, la probabilité qu'elle soit exploitée dans les 30 prochains jours est de 0.16 %, ce qui la place devant 5.1 % des CVE référencées.

Que faire ?

  • Vérifiez si Linux (versions <=6.1.*, 7.0.7, <=7.0.*, <=6.12.*, 0, 6.0.8, 9b67438e315b925a699f0178f4a48baf3d2d6ef4, <2c1143564c71e7497b42d8360a8379ccbb011d3c, 6.12.88, 5.15.209, <=6.6.*, 6.1.175, <149cfb42ad69c7964fd9f2c43831da9152007129, cf2719a21fdb9d4c8e9c834d279163609bef575d, 7.1, <=6.18.*, 5.15.78, 6.1, <7b2d4c04816cdc887f472caaf7fc966cfc107e40, <3485c7236c59c8c34a41af1c4b52982437554e79, <f743eab6486965f276c7e3f1700895f014fdc6db, <=*, <5.15.209, <=5.15.*, <1e1e509b6fd2a42421745bbcd98bd16daad20904, 160fbcf3bfb93c3c086427f9f4c8bc70f217e9be, <daf23014e5d975e72ea9c02b5160d3fcf070ea47, 6.6.140, 6.18.30, <6.1) est présent sur votre parc.
  • Appliquez le correctif ou la version corrigée indiqués dans les références de l'éditeur.
  • À défaut de correctif, limitez l'exposition (filtrage réseau, désactivation du composant).
  • Automatisez la détection : les agents CVE Heimdall (gratuits, open source) corrèlent l'inventaire de vos serveurs avec la base CVE.

Références

Rechercher une autre CVE