CVE-2026-46138 Linux CVE debrief

Who should care

Linux system administrators, kernel maintainers, embedded device manufacturers using Bluetooth LE Audio, and security teams monitoring for denial-of-service conditions in Bluetooth subsystems

Technical summary

The vulnerability exists in net/bluetooth/hci_event.c in the hci_le_create_big_complete_evt() function. When processing LE_Create_BIG_Complete events from a Bluetooth controller, the function uses a while loop to iterate over BT_BOUND connections and assign BIS handles from the event's bis_handle[] flex array. The loop increments index i without checking against ev->num_bis, permitting out-of-bounds reads when the controller provides fewer handles than expected or sets num_bis=0. Rejected out-of-bounds handle values leave connections in BT_BOUND state, causing the same connection to be repeatedly found and processed, resulting in an infinite loop with hci_dev_lock held. The fix adds proper validation and BIG termination when BIS setup fails.

Defensive priority

high

Recommended defensive actions

• Apply kernel updates containing the fix for hci_le_create_big_complete_evt() once available from your Linux distribution
• Monitor stable kernel branches for backported patches to affected versions
• Review Bluetooth controller firmware for compliance with LE Audio BIG event specifications
• Consider disabling Bluetooth or LE Audio features on critical systems until patches are applied
• Audit systems for unexpected hci_dev_lock contention or soft lockups as potential indicators of exploitation attempts

Evidence notes

Vulnerability description confirms OOB read and infinite loop conditions in hci_le_create_big_complete_evt(). Kernel commit references indicate stable branch backports. No CVSS score or severity assigned by NVD at time of disclosure.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.