CVE-2026-46140 Details
Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btmtk: validate WMT event SKB length before struct access btmtk_usb_hci_wmt_sync() casts the WMT event response SKB data to struct btmtk_hci_wmt_evt (7 bytes) and struct btmtk_hci_wmt_evt_funcc (9 bytes) without first checking that the SKB contains enough data. A short firmware response causes out-of-bounds reads from SKB tailroom. Use skb_pull_data() to validate and advance past the base WMT event header. For the FUNC_CTRL case, pull the additional status field bytes before accessing them.
A vulnerability in the Linux kernel's Bluetooth btmtk driver allows for out-of-bounds reads due to improper validation of event response data. The issue arises in the btmtk_usb_hci_wmt_sync() function, which processes WMT event responses by casting the received SKB data to specific structures without first ensuring that the SKB contains sufficient data. This oversight can lead to unauthorized memory access, particularly when a firmware response is shorter than expected, causing reads from the SKB's tailroom. The vulnerability has been addressed by modifying the event handling to include proper length validation before data access.
Users can upgrade to the patched version of the Linux kernel where this vulnerability has been addressed. The specific commit containing the fix is available in the Linux kernel stable tree.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/36c85f7029484d5ede769f8873d16e9c8e35533c | kernel.org | |
| https://git.kernel.org/stable/c/624fb79dadc1b65757986a9d0fdde5c0cf3fe179 | kernel.org | Patch |
| https://git.kernel.org/stable/c/634a4408c0615c523cf7531790f4f14a422b9206 | kernel.org | Patch |
| https://git.kernel.org/stable/c/70d37a8b9229e394cc17ddad47e90b81d80fcd09 | kernel.org | Patch |
| https://git.kernel.org/stable/c/c411cf1bfde951cfa821809cf4020ba177f76e0c | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 6.6.142, < 6.7 >= 6.11, < 6.12.88 >= 6.13, < 6.18.30 >= 6.19, < 7.0.7 7.1 rc1 7.1 rc2 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 4, 2026 | CVE Modified | kernel.org |
| Jun 24, 2026 | Initial Analysis | [email protected] |
| Jun 17, 2026 | CVE Modified | kernel.org |
| May 28, 2026 | New CVE Received | kernel.org |