CVE-2026-46186: Linux Bluetooth Virtio Driver Memory Validation Flaw

Technical summary

The virtbt_rx_handle() function in the Linux kernel Bluetooth virtio driver strips the leading pkt_type byte from received skbs without verifying that the remaining payload meets the minimum HCI header size for that packet type (2 bytes for events, 4 for ACL/ISO, 3 for SCO). When a one-byte packet labeled as HCI_ACLDATA_PKT reaches hci_recv_frame() with skb->len=0, subsequent code in hci_dev_classify_pkt_type() dereferences hci_acl_hdr(skb)->handle unconditionally if the device has active CIS_LINK, BIS_LINK, or PA_LINK connections, reading two bytes of uninitialized RX-buffer data. The fix enforces per-packet-type minimum length checks before forwarding to hci_recv_frame() and rate-limits error logging to prevent log flooding from untrusted backends.

Business impact

Systems relying on Bluetooth connectivity over virtio (common in virtualized environments) face denial-of-service risk through unexpected crashes triggered by malformed Bluetooth frames. While integrity and confidentiality are not directly compromised, unplanned downtime or system instability could disrupt services dependent on Bluetooth functionality. The impact is localized to the affected host and requires local or hypervisor-level access to craft malicious frames.

Affected systems

Linux kernel systems running with Bluetooth virtio driver support enabled, particularly in virtualized or cloud environments where Bluetooth is presented via virtio transport. This affects multiple upstream kernel branches as indicated by the vendors_products list. Systems must have active Bluetooth connections (CIS, BIS, or PA links) to trigger the specific ACL-path dereference, though truncated packets of other types can cause general instability.

Exploitability

Exploitation requires local or privileged access to the hypervisor to inject malformed Bluetooth packets via the virtio backend, or requires control over a Bluetooth device communicating with the virtio driver. The attack is not remotely exploitable from typical network positions. No public exploit code has been identified, and this is not on the CISA KEV catalog. The barrier to exploitation is moderate—an attacker needs backend-level control or local system access.

Remediation

Apply the kernel patch that adds validation logic to virtbt_rx_handle() to enforce minimum packet length requirements per packet type before calling hci_recv_frame(). The fix also implements rate-limited error logging using bt_dev_err_ratelimited() to prevent log flooding. Verify the patch version against your Linux vendor's advisory, as backport timelines vary across distributions.

Patch guidance

Check your Linux distribution's security advisories for Bluetooth virtio patches. Major distributions typically backport such fixes into stable kernel branches within weeks of upstream resolution. Kernel versions should be verified against vendor-specific patch timelines—do not assume upstream kernel version numbers directly apply to your distribution. Test patches in non-production environments first, as Bluetooth driver changes can affect connected devices.

Detection guidance

Monitor kernel logs for rate-limited Bluetooth error messages related to invalid packet lengths from the virtio backend. Enable Bluetooth subsystem debugging if available in your kernel build (CONFIG_BT_DEBUG). On virtualized systems, correlate unexpected Bluetooth device failures or system crashes with hypervisor event logs showing virtio device anomalies. Intrusion detection systems can flag unusual patterns of truncated Bluetooth frames, though this requires deep packet inspection at the hypervisor level.

Why prioritize this

This medium-severity vulnerability affects availability through denial-of-service but requires local or privileged access to exploit. It should be prioritized for patching on systems actively using Bluetooth over virtio (especially cloud or container hosts) but is lower priority for systems without Bluetooth connectivity or non-virtualized deployments. The lack of KEV designation and public exploits suggests active exploitation is not yet widespread.

Risk score, explained

CVSS 5.5 (Medium) reflects high availability impact (complete service disruption possible) offset by low attack vector (local only) and requirement for attacker privileges. The attack surface is confined to the virtio Bluetooth subsystem, limiting exposure compared to network-facing vectors. Environments with strict hypervisor access controls will see further reduced risk.

Frequently asked questions