CVE-2026-46138: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-46138 Overview

CVE-2026-46138 is a Linux kernel vulnerability in the Bluetooth subsystem. The flaw resides in hci_le_create_big_complete_evt() within hci_event.c, which handles the LE Create BIG Complete event for Bluetooth Isochronous (BIG) connections. The function iterates over BT_BOUND connections without validating that the loop index stays within ev->num_bis before accessing the ev->bis_handle[] flexible array. A malicious or malformed controller response can trigger an out-of-bounds read into adjacent heap memory and induce an infinite loop while hci_dev_lock is held.

Critical Impact
An attacker-controlled or malfunctioning Bluetooth controller can trigger heap memory disclosure and a kernel deadlock, resulting in denial of service on affected Linux systems.

Affected Products

Linux kernel versions containing the vulnerable hci_le_create_big_complete_evt() implementation in the Bluetooth HCI event handler
Distributions shipping the affected upstream kernel with Bluetooth Isochronous Channels (BIG) support enabled
Systems with CONFIG_BT enabled and Bluetooth LE Audio / BIS functionality in use

Discovery Timeline

2026-05-28 - CVE-2026-46138 published to NVD
2026-05-28 - Last updated in NVD database

Technical Details for CVE-2026-46138

Vulnerability Analysis

The function hci_le_create_big_complete_evt() processes the HCI_EV_LE_CREATE_BIG_COMPLETE event sent by a Bluetooth controller after a Broadcast Isochronous Group (BIG) is created. The handler walks every connection in BT_BOUND state for the BIG handle using a while loop and reads ev->bis_handle[i++] on each iteration. The loop lacks a bound check against ev->num_bis, the field declaring how many BIS handle entries the event actually contains.

When the controller returns fewer bis_handle entries than the number of bound connections, or when num_bis=0, the loop reads past the end of the flexible array bis_handle[] into adjacent heap memory. This is an Out-of-Bounds Read [CWE-125] inside the kernel heap.

The out-of-bounds values typically exceed HCI_CONN_HANDLE_MAX (0x0EFF), so hci_conn_set_handle() rejects them and the connection stays in BT_BOUND state. The next call to hci_conn_hash_lookup_big_state() finds the same connection again, producing an infinite loop while hci_dev_lock is held. This stalls the Bluetooth subsystem and any caller waiting on the lock, yielding a kernel-level denial of service.

Root Cause

The root cause is missing input validation. The loop trusts that the number of BT_BOUND connections equals the number of bis_handle entries provided by the controller. No comparison between the iteration counter i and ev->num_bis is performed before dereferencing ev->bis_handle[i].

Attack Vector

Exploitation requires a Bluetooth controller, virtual HCI interface, or a fuzzed HCI transport that can deliver a crafted LE_Create_BIG_Complete event with num_bis smaller than the count of bound BIS connections, or with num_bis=0. A local attacker with the ability to attach a malicious HCI device, or a compromised or malfunctioning controller on a paired peripheral path, can trigger the condition.

The vulnerable code path resides in the kernel Bluetooth stack. See the upstream fix commits for the exact patched logic, including Kernel Git Commit 22559ad and Kernel Git Commit 665da0b.

// No verified public exploit code is available.
// Vulnerability mechanism summary:
//   while (conn = hci_conn_hash_lookup_big_state(BIG, BT_BOUND)) {
//       handle = ev->bis_handle[i++];   // missing check: i < ev->num_bis
//       hci_conn_set_handle(conn, handle);
//   }
// Fix: terminate the BIG when not all BIS could be set up.

Detection Methods for CVE-2026-46138

Indicators of Compromise

Kernel soft-lockup or hung-task warnings referencing hci_dev_lock or hci_le_create_big_complete_evt
KASAN reports flagging an out-of-bounds read in hci_event.c near the BIG complete event handler
Bluetooth daemon (bluetoothd) becoming unresponsive after initiating LE Audio broadcast or BIS setup

Detection Strategies

Enable KASAN on test kernels to catch the out-of-bounds read on ev->bis_handle[] during HCI event processing
Monitor dmesg for repeated logging from the Bluetooth subsystem during BIG creation, particularly entries indicating connections stuck in BT_BOUND state
Correlate Bluetooth HCI traffic captures (btmon) with kernel stalls to identify malformed LE Create BIG Complete events containing inconsistent num_bis values

Monitoring Recommendations

Track kernel version inventory and flag hosts not yet running a patched build referenced by the upstream commits
Alert on processes blocked on hci_dev_lock via /proc/*/stack or eBPF-based lock contention probes
Log Bluetooth controller attach and detach events on multi-user systems to detect rogue HCI devices

How to Mitigate CVE-2026-46138

Immediate Actions Required

Apply the upstream Linux kernel fix that terminates the BIG when not all BIS could be set up properly
Update to a distribution kernel package that includes the patched hci_le_create_big_complete_evt() handler
Where patching is not yet possible, disable Bluetooth LE Audio / BIS functionality or unload the Bluetooth module on systems that do not require it

Patch Information

The vulnerability is resolved in the upstream Linux kernel through the following commits: Kernel Git Commit 22559ad, Kernel Git Commit 5ddb801, Kernel Git Commit 665da0b, Kernel Git Commit 6cb7f67, and Kernel Git Commit 77981a5. The fix adds bounds checking against ev->num_bis and tears down the BIG when the controller does not return handles for all bound BIS connections.

Workarounds

Unload the bluetooth kernel module on servers and appliances that do not require Bluetooth: modprobe -r bluetooth
Blacklist Bluetooth modules in /etc/modprobe.d/ on systems without a Bluetooth use case
Restrict physical and USB access to prevent attaching malicious HCI controllers to systems handling sensitive workloads

bash

# Configuration example: disable Bluetooth where unused
echo 'blacklist bluetooth' | sudo tee /etc/modprobe.d/disable-bluetooth.conf
echo 'blacklist btusb'     | sudo tee -a /etc/modprobe.d/disable-bluetooth.conf
sudo systemctl disable --now bluetooth.service
sudo modprobe -r btusb bluetooth