CVE-2026-46138

Technical summary

CVE-2026-46138 is a heap out-of-bounds read (CWE-125) in the Linux kernel's Bluetooth HCI event processing layer, specifically in hci_le_create_big_complete_evt(). The function iterates over BT_BOUND connections for a BIG (Broadcast Isochronous Group) handle using a while loop that accesses ev->bis_handle[i++] without validating that the array index i remains within the bounds defined by ev->num_bis. When a malformed LE_Create_BIG_Complete event arrives with num_bis=0 or fewer bis_handle entries than BT_BOUND connections exist for that BIG, the loop reads past the flex array into adjacent heap memory. Out-of-bounds values typically exceed HCI_CONN_HANDLE_MAX (0x0EFF), causing hci_conn_set_handle() to reject them. Rejected connections remain in BT_BOUND state and are found again by hci_conn_hash_lookup_big_state(), triggering an infinite loop while holding hci_dev_lock—a critical synchronization primitive in the Bluetooth subsystem.

Business impact

This vulnerability creates a denial-of-service vector affecting Linux systems with Bluetooth capabilities. By forcing the kernel into an infinite loop with hci_dev_lock held, an attacker can freeze all Bluetooth operations on the system and potentially degrade overall system responsiveness. Organizations relying on Linux-based IoT devices, embedded systems, or servers with active Bluetooth connectivity face availability risk. The attack requires only adjacent or local network access, making it relevant to environments where untrusted Bluetooth controllers or proximate attackers are a concern.

Affected systems

The Linux kernel across all versions with Bluetooth HCI event handling is affected. This includes consumer devices (laptops, phones running Linux), IoT appliances, automotive systems, and enterprise Linux servers with Bluetooth support enabled. The vulnerability is not version-specific in the provided data; however, patches would typically be backported to stable kernel branches. Verify the specific kernel versions and distributions affected through your vendor's security advisories.

Exploitability

Exploitability requires adjacent or local network access to send a malformed Bluetooth event to the target system. No user interaction or special privileges are needed. The attack is reliable: sending a LE_Create_BIG_Complete event with num_bis=0 or mismatched bis_handle counts directly triggers the infinite loop. However, successful exploitation depends on the system having Bluetooth enabled and the hci_dev_lock contention being observable as a denial of service. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

Remediation

The fix involves terminating the BIG (Broadcast Isochronous Group) if not all BIS (Broadcast Isochronous Sub-channels) can be set up properly, preventing the loop from iterating beyond valid data. This resolves both the out-of-bounds read and the infinite loop condition by ensuring the kernel stops processing when the event data is inconsistent with internal state. Patches have been published and are being integrated into stable kernel releases.

Patch guidance

Apply patches from your Linux distribution's kernel security updates. Check your vendor's advisory page for the specific kernel version numbers that include this fix—these will vary by distribution (Red Hat, Ubuntu, Debian, etc.) and release cycle. Most vendors have released updates to their stable and long-term support branches. Verify the patch has been applied by checking kernel version and, if possible, grepping the kernel source or git history for the fix description. Test in a non-production environment before deploying to production systems.

Detection guidance

Monitor kernel logs for signs of Bluetooth subsystem hangs or lockups, particularly messages related to hci_dev_lock contention or BIG creation failures. On systems with Bluetooth debugging enabled, look for unexpected LE_Create_BIG_Complete events followed by kernel warnings or soft lockups. System monitoring tools may detect sudden CPU thread stalls in Bluetooth-related kernel threads. However, detection is primarily a post-exploitation indicator; prevention via patching is the primary defense. Consider disabling Bluetooth on systems where it is not required.

Why prioritize this

This vulnerability scores 8.1 (HIGH) and combines a reliable denial-of-service trigger with low attack complexity and no authentication requirement. While not yet in the KEV catalog, the combination of a kernel lock freeze and adjacent-network exploitability makes it a credible threat to Bluetooth-enabled Linux deployments. Prioritize patching systems where Bluetooth is actively used or exposed to untrusted networks. Systems with Bluetooth disabled or in isolated networks face lower immediate risk.

Risk score, explained

The CVSS 3.1 score of 8.1 (HIGH) reflects: AV:A (attack vector adjacent network), AC:L (low complexity—no special conditions), PR:N (no privileges needed), UI:N (no user interaction), S:U (scope unchanged), C:H (high confidentiality impact from out-of-bounds read), I:N (no integrity impact), A:H (high availability impact from infinite loop and lock contention). The confidentiality rating acknowledges that out-of-bounds heap reads may leak sensitive kernel memory, while the availability impact is primary due to the kernel lock freeze.

Frequently asked questions