CVE-2026-90257

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: virtio_bt: avoid OOB read of build info string

The virtbt_setup_zephyr() sends the Zephyr vendor command 0xfc08 (Read

Build Information) and hands the response to bt_dev_info() and

hci_set_fw_info() as a "%s" string starting at skb->data + 1, without

checking the length. A backend that answers with status only leaves that

pointer past the end of the received data, so the walk reads adjacent

slab memory until it meets a NUL. Those bytes reach the kernel log and

the firmware-info debugfs file.

To fix this, print the string with a bounded "%.*s" limited to

skb->len - 1. A short or unterminated response then prints as much as

arrived instead of failing setup.

This mirrors commit dd068ef04412 ("Bluetooth: bpa10x: avoid OOB read of

revision string in bpa10x_setup()"), which fixed the identical pattern.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References