CVE-2026-46332: greybus: gb-beagleplay: bound bootloader receive buffering

Synopsis

A buffer overflow vulnerability exists in the Linux kernel's greybus gb-beagleplay driver, specifically in the bootloader receive path. The flaw is reachable from an adjacent network (such as a LAN or VPN segment) without authentication, but requires a victim to interact with the affected system. Successful exploitation gives an attacker full read, write, and crash capability over the affected host. Patched-image rebuilds at versions 6.12.86 and 6.18.27 are available on HarborGuard for environments running an affected kernel version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityDetail

  The vulnerable service must be reachable from an adjacent network such as a local LAN, Wi-Fi segment, or VPN; remote internet-based exploitation is not directly possible.

• AuthenticationNot required

  No credentials or account are needed; an unauthenticated attacker on the adjacent network can send malformed bootloader data to the driver.

• Victim interactionRequired

  A user on the target system must perform some action (such as initiating or accepting a connection) for the exploit to trigger the vulnerable receive path.

• Attack complexityDetail

  The exploit is reliable and condition-free once the attacker is on the adjacent network; no race conditions or special environmental factors are required.

Blast Radius

• An attacker can overflow the rx_buffer and read sensitive kernel memory, including credentials or session material held in adjacent allocations.
• An attacker can corrupt kernel memory structures, modifying persisted state or hijacking kernel control flow.
• An attacker can crash the affected service or the entire kernel, causing a denial of service on the host.
• Combined memory corruption primitives make remote code execution within the kernel context a realistic outcome of successful exploitation.