CVE-2026-90257

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An out-of-bounds read issue exists in the Bluetooth virtio bt component. The virtbt setup zephyr() function sends a Zephyr vendor command 0xfc08 to read build information and processes the response using bt dev info() and hci set fw info() as a string without verifying its length. If a backend provides a response containing only a status, the pointer moves beyond the received data, causing the system to read adjacent slab memory until a NUL character is encountered. This leaked memory can then be written to the kernel log and the firmware-info debugfs file.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.