CVE-2026-46186: Linux Kernel Use-After-Free Vulnerability

CVE-2026-46186 Overview

CVE-2026-46186 is a Linux kernel vulnerability in the virtio_bt Bluetooth driver. The virtbt_rx_handle() function reads the leading pkt_type byte from an RX socket buffer and forwards the remainder to hci_recv_frame() without validating that the payload meets the minimum HCI header size for the selected packet type. A malicious or compromised virtio backend can deliver an undersized completion buffer, causing the HCI core to dereference uninitialized RX-buffer bytes when classifying ACL versus ISO traffic. The flaw affects systems with an active CIS_LINK, BIS_LINK, or PA_LINK connection and impacts every packet type the driver accepts.

Critical Impact
An untrusted virtio backend can trigger out-of-bounds reads of uninitialized kernel memory in the HCI layer through undersized Bluetooth RX completions.

Affected Products

Linux kernel — drivers/bluetooth/virtio_bt.c
Guest kernels using the virtio Bluetooth transport with HCI ISO connection support
Stable kernel branches addressed by commits 1e1e509, 2c11435, 3485c72, daf2301, and f743eab

Discovery Timeline

2026-05-28 - CVE-2026-46186 published to NVD
2026-05-28 - Last updated in NVD database

Technical Details for CVE-2026-46186

Vulnerability Analysis

The defect resides in virtbt_rx_handle() within the Linux kernel virtio Bluetooth driver. The function strips the leading pkt_type byte from the receive skb and dispatches the remainder to hci_recv_frame() for HCI event, ACL, SCO, and ISO packet types. None of the switch cases verify that skb->len covers the fixed HCI header for the selected packet type before invoking the core receive path. This is an uninitialized memory use issue compounded by missing input validation [CWE-908, CWE-20].

After a prior patch clamped the backend-supplied used.len to the range [1, VIRTBT_RX_BUF_SIZE], a single-byte completion still reaches hci_recv_frame() with skb->len already pulled to zero. When the stripped byte is HCI_ACLDATA_PKT, the classification fast path in hci_dev_classify_pkt_type() dereferences hci_acl_hdr(skb)->handle, reading two bytes of uninitialized RX-buffer data whenever the HCI device has an active CIS_LINK, BIS_LINK, or PA_LINK connection.

Root Cause

The driver trusts length metadata supplied by the virtio backend without enforcing per-packet-type minimum header sizes. The HCI core assumes the caller has already validated header coverage, so the missing check in the driver propagates into pointer arithmetic over uninitialized memory.

Attack Vector

A malicious or compromised virtio Bluetooth backend, such as a hostile hypervisor or vhost-user device, can return a one-byte RX completion with pkt_type set to HCI_ACLDATA_PKT. When the guest has an active ISO connection, the HCI classifier reads beyond the consumed buffer into uninitialized memory. The vulnerability is reachable without guest-side privilege because Bluetooth RX completions are processed in the kernel data path. Public exploit code is not currently available.

Technical details of the fix are described in the upstream commits referenced below. The remediation requires skb->len to cover the fixed header size for the selected type — 2 bytes for HCI events, 4 for ACL, 3 for SCO, and 4 for ISO — before calling hci_recv_frame(), and drops the frame with bt_dev_err_ratelimited() otherwise. See the Kernel Git Commit 1e1e509 and Kernel Git Commit f743eab for the patch sources.

Detection Methods for CVE-2026-46186

Indicators of Compromise

Repeated bt_dev_err_ratelimited() messages from the virtio_bt driver indicating undersized RX frames after patching.
Unexpected kernel oops or KASAN reports in hci_dev_classify_pkt_type() or hci_recv_frame() paths on guest systems.
Anomalous virtio Bluetooth RX completion patterns with used.len values of 1 to 4 bytes.

Detection Strategies

Enable KASAN (Kernel Address Sanitizer) on test guests to catch uninitialized reads from RX skb buffers.
Audit installed kernel versions against the patched stable branches referenced in the upstream commits.
Inspect virtualization platform logs for guests using virtio Bluetooth devices with ISO transport support enabled.

Monitoring Recommendations

Forward guest kernel ring buffer messages to a central log store and alert on Bluetooth subsystem error rate spikes.
Track CVE feed updates for downstream distribution kernels that backport the upstream virtio_bt validation patches.
Monitor hypervisor host integrity to detect compromise of any component that could act as a hostile virtio backend.

How to Mitigate CVE-2026-46186

Immediate Actions Required

Apply the upstream Linux kernel patches that add per-packet-type header length validation in virtbt_rx_handle().
Update guest kernels in virtualized environments where the virtio_bt driver is loaded.
Where patching is delayed, blacklist or unload the virtio_bt kernel module if Bluetooth passthrough is not required.

Patch Information

The fix has been merged into upstream Linux stable trees. Reference commits include Kernel Git Commit 1e1e509, Kernel Git Commit 2c11435, Kernel Git Commit 3485c72, Kernel Git Commit daf2301, and Kernel Git Commit f743eab. Consult your distribution security tracker for backported package versions.

Workarounds

Disable the virtio_bt module on guest systems that do not require Bluetooth: modprobe -r virtio_bt and add a blacklist virtio_bt entry under /etc/modprobe.d/.
Remove virtio Bluetooth device configuration from guest VM definitions until kernel updates are applied.
Restrict execution of untrusted hypervisor or backend components that could deliver malformed virtio completions.

bash

# Configuration example: disable the vulnerable driver on unpatched guests
sudo modprobe -r virtio_bt
echo "blacklist virtio_bt" | sudo tee /etc/modprobe.d/blacklist-virtio_bt.conf
sudo update-initramfs -u