CVE-2026-46332: Linux Kernel Greybus BeaglePlay Buffer Overflow

Technical summary

CVE-2026-46332 is a classic buffer overflow (CWE-120) in the cc1352_bootloader_rx() function within the Linux kernel's Greybus gb-beagleplay driver. The function appends serdev (serial device) data chunks into a fixed-size rx_buffer without bounds checking. Because the helper function preserves state between callbacks and may process multiple packets in a single callback, the cumulative data can exceed the buffer's allocated space. The fix implements a pre-copy validation that checks whether the incoming chunk size exceeds remaining buffer capacity. If the buffer would overflow, the staged data is discarded and bytes are consumed to prevent the overflow condition.

Business impact

This vulnerability could allow an attacker to execute arbitrary code on systems running affected Linux kernels with Greybus BeaglePlay hardware support enabled. The impact is limited to systems with this specific hardware or driver enabled, but on vulnerable systems, code execution could lead to complete system compromise, privilege escalation, and lateral movement within networked environments. Organizations deploying BeaglePlay devices or development boards should assess their kernel configurations and deployment inventory.

Affected systems

The vulnerability affects the Linux kernel's Greybus BeaglePlay bootloader driver component. Systems at risk include those running Linux kernels with the gb-beagleplay driver compiled and enabled, particularly BeaglePlay development boards and systems using similar Greybus-based communication hardware. The vulnerability does not affect systems without this driver enabled or running non-Linux operating systems.

Exploitability

Exploitation requires adjacent or local network access (AV:A per CVSS), with low attack complexity and no authentication or user interaction required for the technical exploit. However, the practical exploitation surface is narrowed by the specificity of the hardware and driver combination. An attacker would need either physical proximity to the device's serial communication link or network access if the serial device is exposed over a network medium. The CVSS rating of 8.0 (HIGH) reflects the severity of impact if exploited, though the limited scope of affected deployments may reduce real-world risk in many environments.

Remediation

Apply kernel updates that include the fix for the cc1352_bootloader_rx() function bounds checking. Verify the specific kernel version containing the patch against official Linux kernel security advisories and your distribution's patch releases. As an interim measure, disable the gb-beagleplay driver if the hardware is not in use, or isolate systems running this driver from untrusted network segments.

Patch guidance

Check with your Linux distribution (Red Hat, Ubuntu, Debian, etc.) for kernel updates addressing CVE-2026-46332. The fix involves validating incoming data chunk size against remaining buffer space in cc1352_bootloader_rx(). Verify against the vendor advisory that your kernel version includes the bounds-checking implementation that drops staged data rather than overflowing the buffer when insufficient space remains. Test patches in non-production environments before deployment, particularly if you manage fleets of BeaglePlay or similar Greybus devices.

Detection guidance

Monitor system logs for bootloader communication errors or crashes originating from the Greybus driver. Kernel audit logs may show buffer-related warnings if available. Network-based detection is difficult without visibility into serial device traffic; focus on host-level kernel logs and system stability monitoring. If you manage BeaglePlay hardware, maintain inventory and verify kernel versions in use. Intrusion detection systems may flag unusual patterns in serial communication if it is exposed via network protocols, but direct serial line inspection provides the most reliable detection.

Why prioritize this

While this vulnerability carries a HIGH CVSS score (8.0) due to potential code execution and impact across confidentiality, integrity, and availability, its real-world risk is moderated by the narrow hardware scope. Organizations without BeaglePlay or Greybus-based devices deployed should deprioritize relative to broader kernel vulnerabilities affecting mainstream systems. However, organizations actively using this hardware should treat it as high priority to prevent potential supply chain or development platform compromises.

Risk score, explained

The CVSS 3.1 score of 8.0 reflects a HIGH severity vulnerability because successful exploitation could lead to complete system compromise (high impact across C, I, and A). The vector CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H indicates adjacent access requirement and the need for user interaction, which moderates the score slightly from maximum severity. The score appropriately weights the impact severity against the narrower attack surface compared to network-wide kernel vulnerabilities.

Frequently asked questions