PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46186 Linux CVE debrief

A vulnerability in the Linux kernel's Bluetooth virtio transport driver (virtio_bt) allowed a malicious or compromised backend to trigger out-of-bounds memory reads. The virtbt_rx_handle() function processed received packets without validating that the remaining payload length met the minimum header size requirements for the declared packet type (event, ACL, SCO, or ISO). A one-byte packet could reach hci_recv_frame() with zero remaining length, causing the ACL-vs-ISO classification fast-path to dereference hci_acl_hdr(skb)->handle and read two bytes of uninitialized RX buffer data when CIS_LINK, BIS_LINK, or PA_LINK connections were active. The fix adds length validation against per-type minimum header sizes (2 bytes for events, 4 for ACL, 3 for SCO, 4 for ISO) before calling hci_recv_frame(), with ratelimited error logging to prevent log flooding from untrusted backends.

Vendor
Linux
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-06-11
Advisory published
2026-05-28
Advisory updated
2026-06-11

Who should care

Organizations running virtualized Linux workloads with Bluetooth virtio transport enabled; cloud providers offering nested virtualization with Bluetooth passthrough; security teams monitoring kernel memory safety issues in virtualization stacks

Technical summary

The virtio_bt driver in the Linux kernel failed to validate that received Bluetooth packets contained sufficient data for their declared packet type headers. After stripping the leading pkt_type byte, the driver forwarded remaining SKB data to hci_recv_frame() without checking minimum length requirements: 2 bytes for HCI events, 4 bytes for ACL data, 3 bytes for SCO data, and 4 bytes for ISO data. This allowed a malicious virtio backend to send single-byte packets that would cause the HCI core to read beyond valid buffer boundaries when classifying packet types, specifically triggering uninitialized memory reads in hci_dev_classify_pkt_type() when ISO connections were active. The vulnerability is exploitable only from within the virtualized environment by a compromised backend, not remotely over Bluetooth radio.

Defensive priority

high

Recommended defensive actions

  • Apply kernel patches from stable branches: 6.1.x, 6.6.x, 6.12.x, 6.14.x, and 6.15.x
  • Validate virtio_bt driver is updated to include pkt_type header length validation
  • Monitor kernel logs for bt_dev_err_ratelimited messages indicating malformed packets from backend
  • Review virtualization backend security posture as exploit requires compromised or malicious backend
  • Consider disabling Bluetooth virtio transport in high-security virtualized environments if not required

Evidence notes

Vulnerability description and patch details sourced from official CVE record and kernel.org stable tree commits. The issue was resolved by commits across multiple stable kernel branches.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46186 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46186

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46186 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46186

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/1e1e509b6fd2a42421745bbcd98bd16daad20904

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/2c1143564c71e7497b42d8360a8379ccbb011d3c

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/3485c7236c59c8c34a41af1c4b52982437554e79

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/daf23014e5d975e72ea9c02b5160d3fcf070ea47

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/f743eab6486965f276c7e3f1700895f014fdc6db

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.