Cloudanix VulnDB

CVE-2026-90257

None

CVSS

—

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A bug in how Linux handles responses from certain virtual Bluetooth devices can accidentally copy nearby kernel memory into log files, potentially giving attackers extra information.

Chainable
Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Data Exposure
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Low
Patch risk
Low

What it actually does

Out-of-bounds read of kernel slab memory when virtbt_setup_zephyr() parses a short or status-only response to the Zephyr 0xfc08 Read Build Information command, passing skb->data + 1 as an unbounded %s string to bt_dev_info() and hci_set_fw_info().

Why it matters to the business

Kernel memory contents adjacent to the skb can leak into the kernel log and a debugfs file, providing attackers with information that may help craft further exploits on affected Linux systems.

How an attack unfolds

An attacker who controls or emulates the virtio_bt backend supplies a minimal status-only reply to the Read Build Information vendor command; the kernel then walks past the end of the received skb until a NUL byte, exposing adjacent slab data through logs or the firmware-info debugfs entry.

How to fix it

Apply the upstream fix that changes the print to a bounded "%.*s" limited to skb->len - 1; rebuild and deploy the patched kernel on all affected systems.

How to confirm the fix worked

Confirm the patched kernel is running, reproduce the short-response scenario in a test environment, and verify that only the received bytes appear in logs without adjacent memory contents.

Typical attack path

  1. Gain control of or emulate the virtio Bluetooth backend
  2. Respond to Zephyr 0xfc08 command with status byte only
  3. Trigger virtbt_setup_zephyr() during device initialization
  4. Read leaked kernel memory from dmesg or debugfs

How to detect it

Search kernel logs and debugfs for Bluetooth build-information strings that appear truncated or contain unexpected binary data; correlate with virtio_bt device initialization events.

What your security team should do

  • Prioritize kernel updates for systems exposing virtio_bt
  • Disable virtio Bluetooth interfaces when not required
  • Monitor kernel logs for unexpected Bluetooth build-info entries
  • Review debugfs access controls around firmware-info

The record

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: virtio_bt: avoid OOB read of build info string The virtbt_setup_zephyr() sends the Zephyr vendor command 0xfc08 (Read Build Information) and hands the response to bt_dev_info() and hci_set_fw_info() as a "%s" string starting at skb->data + 1, without checking the length. A backend that answers with status only leaves that pointer past the end of the received data, so the walk reads adjacent slab memory until it meets a NUL. Those bytes reach the kernel log and the firmware-info debugfs file. To fix this, print the string with a bounded "%.*s" limited to skb->len - 1. A short or unterminated response then prints as much as arrived instead of failing setup. This mirrors commit dd068ef04412 ("Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup()"), which fixed the identical pattern.

Affected packages

Ecosystem Package Introduced Fixed