CVE-2026-46123

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description In the virtio bt module, the virtbt rx work() function calls skb put(skb, len) using a length value obtained from virtqueue get buf() without validating it against the buffer size exposed to the device. Because the RX skb is exposed as 1000 bytes, a malicious or buggy backend can report a length between 1001 and the available skb tailroom(skb), leading to the inclusion of uninitialized kernel heap bytes. Additionally, the system accepts a length of 0, which results in virtbt rx handle() reading the pkt type byte from uninitialized memory.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.