CVE-2026-46123 Overview
CVE-2026-46123 is a Linux kernel vulnerability in the virtio_bt Bluetooth transport driver. The flaw resides in virtbt_rx_work(), which calls skb_put(skb, len) using a length value returned by virtqueue_get_buf() without validating it against the buffer size exposed to the device. A malicious or buggy virtio backend can report a used.len larger than the 1000-byte RX buffer, causing the kernel to expose uninitialized heap memory. The same path also accepts len == 0, allowing virtbt_rx_handle() to read an uninitialized pkt_type byte. The issue is addressed across multiple stable kernel branches.
Critical Impact
A compromised or malicious virtio backend can trigger reads of uninitialized kernel heap memory through the Bluetooth virtio transport, potentially leaking sensitive kernel data to userspace.
Affected Products
- Linux kernel builds including the virtio_bt driver prior to the fix commits
- Virtualized guests using virtio Bluetooth (CONFIG_BT_VIRTIO)
- Stable kernel branches referenced by commits 21bd244, 6c17300, b40cdd1, e6b4296, and ed41c81
Discovery Timeline
- 2026-05-28 - CVE-2026-46123 published to NVD
- 2026-05-28 - Last updated in NVD database
Technical Details for CVE-2026-46123
Vulnerability Analysis
The defect lives in drivers/bluetooth/virtio_bt.c. The RX socket buffer is allocated in virtbt_add_inbuf() and registered with virtio through sg_init_one() as exactly 1000 bytes. When the device completes a buffer, virtbt_rx_work() reads the reported length from virtqueue_get_buf() and passes it directly to skb_put(skb, len).
The original code only checked len against skb_tailroom(skb). This check is insufficient because alloc_skb() typically returns more tailroom than the 1000 bytes actually exposed to the device. A backend can therefore report used.len values between 1001 and skb_tailroom(skb). skb_put() then extends the buffer over kernel heap memory that the device never wrote, leaking uninitialized contents into the Bluetooth receive path.
The same routine accepts len == 0. In that case skb_put(skb, 0) leaves the buffer empty, but virtbt_rx_handle() still dereferences skb->data to read the pkt_type byte, consuming uninitialized memory.
Root Cause
The RX buffer size was defined inconsistently between allocation and validation. The driver lacked a single authoritative buffer size constant, so the bound check did not match the buffer actually shared with the device. This is the same class of bug fixed in commit c04db81cd028 ("net/9p: Fix buffer overflow in USB transport layer").
Attack Vector
Exploitation requires a malicious or compromised virtio backend, such as a hostile hypervisor, a tampered VMM, or a buggy emulated device. The backend reports an inflated or zero used.len to the guest kernel. The guest then processes uninitialized heap memory as Bluetooth frame data, which can be observed through HCI userspace interfaces. This is an information disclosure primitive that can aid in defeating KASLR or extracting sensitive kernel state.
No synthetic exploitation code is provided. The patch series referenced in the kernel commits illustrates the corrected bounds check.
Detection Methods for CVE-2026-46123
Indicators of Compromise
- Repeated rate-limited kernel log entries from virtio_bt reporting invalid RX lengths (post-patch builds emit bt_dev_err_ratelimited() messages).
- Unexpected virtio_bt device activity inside guests that do not use Bluetooth functionality.
- Anomalous HCI traffic patterns reaching userspace consumers of /dev/vhci or BlueZ sockets.
Detection Strategies
- Inventory guest kernels and identify systems running virtio_bt without the fix commits applied.
- Audit hypervisor and emulated device configurations for untrusted backends exposing virtio Bluetooth to guests.
- Use kernel runtime sanitizers (KASAN) in test environments to surface out-of-bounds reads triggered by crafted used.len values.
Monitoring Recommendations
- Forward dmesg and journald output to a central log store and alert on virtio_bt error messages.
- Track kernel package versions across the fleet and flag hosts missing the relevant stable kernel update.
- Monitor virtualization platforms for unauthorized changes to guest device topology that add Bluetooth virtio devices.
How to Mitigate CVE-2026-46123
Immediate Actions Required
- Apply the upstream fix from the referenced stable kernel commits and reboot affected hosts.
- Disable the virtio_bt driver on guests that do not require virtualized Bluetooth by blacklisting the module.
- Restrict guest exposure to untrusted virtio backends and review hypervisor device passthrough policies.
Patch Information
The fix introduces a single VIRTBT_RX_BUF_SIZE constant used by both alloc_skb() and sg_init_one(), and gates virtbt_rx_work() on that same constant. It also rejects used.len == 0 so empty completions cannot reach virtbt_rx_handle(). Log messages use bt_dev_err_ratelimited() to prevent log flooding from a hostile backend. See Kernel Commit 21bd244, Kernel Commit 6c17300, Kernel Commit b40cdd1, Kernel Commit e6b4296, and Kernel Commit ed41c81.
Workarounds
- Blacklist the virtio_bt kernel module on guests that do not need Bluetooth virtio support.
- Remove emulated Bluetooth devices from guest configurations in libvirt, QEMU, or the cloud provider console.
- Run guests only on trusted hypervisors and avoid exposing virtio Bluetooth from untrusted backends.
# Configuration example: blacklist the virtio_bt module on a Linux guest
echo 'blacklist virtio_bt' | sudo tee /etc/modprobe.d/disable-virtio-bt.conf
sudo rmmod virtio_bt 2>/dev/null || true
sudo update-initramfs -u
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
