CVE-2026-90251

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: MSFT: validate evt_prefix_len against the response length

read_supported_features() only checks that the response covers the fixed

part of struct msft_rp_read_supported_features, which is 11 bytes:

if (skb->len < sizeof(*rp)) {

bt_dev_err(hdev, "MSFT supported features length mismatch");

goto failed;

}

evt_prefix[] is a flexible array member and rp->evt_prefix_len is an

unvalidated u8 taken straight out of that response, so

msft->evt_prefix = kmemdup(rp->evt_prefix, rp->evt_prefix_len,

GFP_KERNEL);

copies up to 255 bytes from a reply that may have carried none of them.

What is copied is data the controller never sent, and it is then used to

match incoming vendor events in msft_vendor_evt().

This is not an out-of-bounds access. An skb data allocation always has

at least SKB_DATA_ALIGN(sizeof(struct skb_shared_info)) bytes past the

payload, which is more than the 255 byte maximum, so the r

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References