CVE-2026-46123

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: virtio_bt: clamp rx length before skb_put

virtbt_rx_work() calls skb_put(skb, len) where len comes directly

from virtqueue_get_buf() with no validation against the buffer we

posted to the device. The RX skb is allocated in virtbt_add_inbuf()

and exposed to virtio as exactly 1000 bytes via sg_init_one().

Checking len against skb_tailroom(skb) is not sufficient because

alloc_skb() can leave more tailroom than the 1000 bytes actually

handed to the device. A malicious or buggy backend can therefore

report used.len between 1001 and skb_tailroom(skb), causing skb_put()

to include uninitialized kernel heap bytes that were never written by

the device.

The same path also accepts len == 0, in which case skb_put(skb, 0)

leaves the skb empty but virtbt_rx_handle() still reads the pkt_type

byte from skb->data, consuming uninitialized memory.

Define VIRTBT_RX_BUF_SIZE once and reuse it in alloc_skb() and

sg_init_one(

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References