CVE-2026-46140

Technical summary

The btmtk_usb_hci_wmt_sync() function in the Linux kernel Bluetooth subsystem performs unsafe pointer casts on socket buffer (SKB) data without length validation. Specifically, it casts WMT (Wireless Management Transport) event response data to struct btmtk_hci_wmt_evt (7 bytes) and struct btmtk_hci_wmt_evt_funcc (9 bytes) without confirming the SKB contains the required minimum payload. This allows out-of-bounds reads into SKB tailroom when a firmware response is shorter than expected. The fix introduces skb_pull_data() calls to atomically validate buffer length and advance the read pointer, preventing access to uninitialized or freed memory regions.

Business impact

Systems running vulnerable Linux kernels with Bluetooth hardware are exposed to local privilege escalation and information disclosure. A user with local access and Bluetooth capability (which may include unprivileged processes in permissive configurations) could read kernel memory to extract sensitive data or trigger denial-of-service conditions. In environments where Bluetooth functionality is exposed to untrusted users or guest VMs, this creates a containment breach risk.

Affected systems

All Linux kernel versions containing the vulnerable btmtk driver code are affected. The vulnerability impacts systems with MediaTek Bluetooth USB adapters or integrated Bluetooth chipsets using the btmtk driver. Affected platforms include consumer laptops, edge devices, and IoT systems running Linux with Bluetooth support. Verify your kernel version against the vendor advisory and check dmesg or modinfo for btmtk driver presence.

Exploitability

Exploitation requires local system access and Bluetooth privileges. An attacker cannot trigger this remotely; however, the barrier to exploitation is relatively low—crafting a malformed Bluetooth response or using a compromised Bluetooth device is within reach of determined local users. The vulnerability does not require elevated privileges initially, though triggering reliable information leakage may depend on memory layout and timing. No public exploit code is known at this time, but the flaw is straightforward enough that proof-of-concept development would be feasible for skilled researchers.

Remediation

Apply kernel patches that implement proper SKB length validation using skb_pull_data() before struct member access in the btmtk driver. Verify against the vendor advisory for the exact patch version applicable to your kernel series. Alternatively, disable Bluetooth functionality if not required, or restrict Bluetooth access via LSM policies or userspace permissions until patching is complete.

Patch guidance

Consult the Linux kernel security advisory and your distribution's patch tracking system (e.g., Ubuntu Security Notices, Red Hat Advisories) for the specific kernel version containing the fix. Patch versions vary by stable kernel branch; verify the exact version against your current kernel release. Most distributions will backport this fix to stable and LTS releases. Test patches in a non-production environment before wider deployment, particularly if Bluetooth is critical to your use case.

Detection guidance

Monitor kernel logs for Bluetooth (btmtk) driver errors or memory access warnings. Systems running kernel address sanitizer (KASAN) or other memory safety tools will generate diagnostics on exploitation attempts. Endpoint detection tools tracking unusual Bluetooth device interactions or firmware responses may identify attack attempts, though direct visibility into in-kernel buffer reads is limited without instrumentation. Threat hunting should focus on systems with Bluetooth enabled in untrusted sharing scenarios.

Why prioritize this

This vulnerability scores HIGH (7.1 CVSS) due to high confidentiality impact (kernel memory disclosure) and high availability impact (denial of service). Local exploitability is the main limiting factor; however, in multi-tenant or guest-facing environments, local access may be readily available. The btmtk driver affects a broad range of consumer and embedded systems. Prioritize patching for systems where Bluetooth is exposed to less-trusted users or where kernel memory isolation is a regulatory requirement.

Risk score, explained

CVSS 7.1 reflects the combination of local attack vector (AV:L), low attack complexity (AC:L), low privilege requirement (PR:L), and high impact on confidentiality (C:H) and availability (A:H). The score does not account for integrity impact because out-of-bounds reads do not directly modify kernel state. In environments where local access is tightly controlled, actual risk is lower; in open-access or shared systems, risk approaches the scored level.

Frequently asked questions