CVE-2026-90257
Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: virtio_bt: avoid OOB read of build info string The virtbt_setup_zephyr() sends the Zephyr vendor command 0xfc08 (Read Build Information) and hands the response to bt_dev_info() and hci_set_fw_info() as a "%s" string starting at skb->data + 1, without checking the length. A backend that answers with status only leaves that pointer past the end of the received data, so the walk reads adjacent slab memory until it meets a NUL. Those bytes reach the kernel log and the firmware-info debugfs file. To fix this, print the string with a bounded "%.*s" limited to skb->len - 1. A short or unterminated response then prints as much as arrived instead of failing setup. This mirrors commit dd068ef04412 ("Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup()"), which fixed the identical pattern.
How to fix
- Linux Linuxfb445b3466a8d1c7a0b0d0676fb475e3ce22d94e, d08c99abf06133a7829d46627e77e3315ca974d2, 0e388d805233a883a31271676eae6031dfc9e898, 54e9387eb7546eaa6f600220599d55740956ffc3, be1e3df2c49c91b0a052c6563884e8d39bd768b2, 84ea9c99874804f5ca13f35bbc186ba93902f30f, 502adc06ba76dee19c292ae4a07d74d202fe734d or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | afd2daa26c7abd734d78bd274fc6c59a15e61063 ≤ v < fb445b3466a8d1c7a0b0d0676fb475e3ce22d94e, afd2daa26c7abd734d78bd274fc6c59a15e61063 ≤ v < d08c99abf06133a7829d46627e77e3315ca974d2, afd2daa26c7abd734d78bd274fc6c59a15e61063 ≤ v < 0e388d805233a883a31271676eae6031dfc9e898, afd2daa26c7abd734d78bd274fc6c59a15e61063 ≤ v < 54e9387eb7546eaa6f600220599d55740956ffc3, afd2daa26c7abd734d78bd274fc6c59a15e61063 ≤ v < be1e3df2c49c91b0a052c6563884e8d39bd768b2, afd2daa26c7abd734d78bd274fc6c59a15e61063 ≤ v < 84ea9c99874804f5ca13f35bbc186ba93902f30f, afd2daa26c7abd734d78bd274fc6c59a15e61063 ≤ v < 502adc06ba76dee19c292ae4a07d74d202fe734d, 5.13 | fb445b3466a8d1c7a0b0d0676fb475e3ce22d94e, d08c99abf06133a7829d46627e77e3315ca974d2, 0e388d805233a883a31271676eae6031dfc9e898, 54e9387eb7546eaa6f600220599d55740956ffc3, be1e3df2c49c91b0a052c6563884e8d39bd768b2, 84ea9c99874804f5ca13f35bbc186ba93902f30f, 502adc06ba76dee19c292ae4a07d74d202fe734d |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.