CVE-2026-46123: Bluetooth: virtio_bt: clamp rx length before skb_put

Synopsis

A heap-data-disclosure and denial-of-service vulnerability exists in the Linux kernel's virtio Bluetooth driver (virtio_bt). The flaw is reachable locally with no authentication required, meaning an attacker who already has code running on the host or who controls the virtio backend device can trigger it. Successful exploitation exposes uninitialized kernel heap bytes to user space and can crash the affected service. Patched-image rebuilds at the fix versions (5.16, 6.1, 6.6.140, and the listed commit SHAs) are available on HarborGuard for environments running affected kernel versions.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host, or control over the virtio backend device; no network path to the service is required.

• AuthenticationNot required

  No credentials or account privileges are required to trigger the vulnerability once local or backend access is established.

• Victim interactionNot required

  No user interaction is needed; the attacker triggers the flaw by supplying a crafted used.len value through the virtio backend without any action from a victim.

• Attack complexityDetail

  Exploit conditions are straightforward and reliable; no race conditions, memory-layout dependencies, or special environmental factors are required to produce the overflow.

Blast Radius

• An attacker reads uninitialized kernel heap bytes that were never written by the device, which may include residual data such as keys, tokens, or other kernel objects previously occupying that memory region.
• An attacker can supply a zero-length completion that causes virtbt_rx_handle() to consume uninitialized memory when reading the pkt_type byte, producing unpredictable kernel behavior.
• A malicious or buggy virtio backend can repeatedly trigger the out-of-bounds skb_put(), destabilizing or crashing the Bluetooth subsystem on the host.
• Kernel log flooding is possible via the unguarded error path, degrading observability and potentially masking other concurrent attacks.