CVE-2026-90251

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the Bluetooth MSFT implementation where the read supported features() function fails to properly validate the evt prefix len variable against the actual response length. The function only verifies that the response covers the fixed 11-byte part of the msft rp read supported features structure. Because evt prefix[] is a flexible array member and evt prefix len is an unvalidated value provided by the controller, the system may use kmemdup() to copy up to 255 bytes of data that the controller never actually sent. This data is subsequently used to match incoming vendor events in the msft vendor evt() function. While this does not result in an out-of-bounds access due to allocation slack in the socket buffer (skb), it allows the controller to control the length and content of the data read by the host.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.