« Volver al listado

CVE-2026-90257

Estado: RecibidaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: virtio_bt: avoid OOB read of build info string

The virtbt_setup_zephyr() sends the Zephyr vendor command 0xfc08 (Read Build Information) and hands the response to bt_dev_info() and hci_set_fw_info() as a "%s" string starting at skb->data + 1, without checking the length. A backend that answers with status only leaves that pointer past the end of the received data, so the walk reads adjacent slab memory until it meets a NUL. Those bytes reach the kernel log and the firmware-info debugfs file.

To fix this, print the string with a bounded "%.*s" limited to skb->len - 1. A short or unterminated response then prints as much as arrived instead of failing setup.

Leer descripción completaMostrar menos

This mirrors commit dd068ef04412 ("Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup()"), which fixed the identical pattern.

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-90257",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "afd2daa26c7abd734d78bd274fc6c59a15e61063",
              "lessThan": "fb445b3466a8d1c7a0b0d0676fb475e3ce22d94e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "afd2daa26c7abd734d78bd274fc6c59a15e61063",
              "lessThan": "d08c99abf06133a7829d46627e77e3315ca974d2",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "afd2daa26c7abd734d78bd274fc6c59a15e61063",
              "lessThan": "0e388d805233a883a31271676eae6031dfc9e898",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "afd2daa26c7abd734d78bd274fc6c59a15e61063",
              "lessThan": "54e9387eb7546eaa6f600220599d55740956ffc3",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "afd2daa26c7abd734d78bd274fc6c59a15e61063",
              "lessThan": "be1e3df2c49c91b0a052c6563884e8d39bd768b2",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "afd2daa26c7abd734d78bd274fc6c59a15e61063",
              "lessThan": "84ea9c99874804f5ca13f35bbc186ba93902f30f",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "afd2daa26c7abd734d78bd274fc6c59a15e61063",
              "lessThan": "502adc06ba76dee19c292ae4a07d74d202fe734d",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/bluetooth/virtio_bt.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.13"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "5.13",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/bluetooth/virtio_bt.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-17T17:17:22.087",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/0e388d805233a883a31271676eae6031dfc9e898",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/502adc06ba76dee19c292ae4a07d74d202fe734d",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/54e9387eb7546eaa6f600220599d55740956ffc3",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/84ea9c99874804f5ca13f35bbc186ba93902f30f",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/be1e3df2c49c91b0a052c6563884e8d39bd768b2",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/d08c99abf06133a7829d46627e77e3315ca974d2",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/fb445b3466a8d1c7a0b0d0676fb475e3ce22d94e",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: virtio_bt: avoid OOB read of build info string\n\nThe virtbt_setup_zephyr() sends the Zephyr vendor command 0xfc08 (Read\nBuild Information) and hands the response to bt_dev_info() and\nhci_set_fw_info() as a \"%s\" string starting at skb->data + 1, without\nchecking the length. A backend that answers with status only leaves that\npointer past the end of the received data, so the walk reads adjacent\nslab memory until it meets a NUL. Those bytes reach the kernel log and\nthe firmware-info debugfs file.\n\nTo fix this, print the string with a bounded \"%.*s\" limited to\nskb->len - 1. A short or unterminated response then prints as much as\narrived instead of failing setup.\n\nThis mirrors commit dd068ef04412 (\"Bluetooth: bpa10x: avoid OOB read of\nrevision string in bpa10x_setup()\"), which fixed the identical pattern."
    }
  ],
  "lastModified": "2026-09-17T17:17:22.087",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}