Skip to main content

Linux Kernel CVE-2026-46140

| EUVDEUVD-2026-32767 HIGH
Out-of-bounds Read (CWE-125)
2026-05-28 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-vpw8-mw7p-fcg5
Linux Buffer Overflow Information Disclosure
High
Disputed · 7.1 NVD
Share

Severity by source

Sources disagree (Low–High)
NVD PRIMARY
7.1 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
vuln.today AI
7.1 HIGH

Local trigger via a low-privileged user or attached MediaTek device (AV:L/PR:L); OOB read leaks kernel memory (C:H) and can panic the host (A:H) with no integrity impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
6.3 MEDIUM
AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
Red Hat
5.5 LOW
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jun 24, 2026 - 17:39 vuln.today
CVSS changed
Jun 24, 2026 - 17:38 NVD
7.1 (HIGH)
Patch available
May 28, 2026 - 12:31 EUVD
CVE Published
May 28, 2026 - 10:16 nvd
HIGH 7.1
CVE Published
May 28, 2026 - 10:16 nvd
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btmtk: validate WMT event SKB length before struct access

btmtk_usb_hci_wmt_sync() casts the WMT event response SKB data to struct btmtk_hci_wmt_evt (7 bytes) and struct btmtk_hci_wmt_evt_funcc (9 bytes) without first checking that the SKB contains enough data. A short firmware response causes out-of-bounds reads from SKB tailroom.

Use skb_pull_data() to validate and advance past the base WMT event header. For the FUNC_CTRL case, pull the additional status field bytes before accessing them.

AnalysisAI

Out-of-bounds kernel memory read in the Linux kernel's MediaTek Bluetooth driver (btmtk) lets a short or malformed WMT firmware event response trigger reads past the SKB tailroom in btmtk_usb_hci_wmt_sync(), potentially leaking adjacent kernel memory or crashing the host. The flaw affects systems using MediaTek USB Bluetooth controllers (MT76xx family) on kernels around 6.11 through release candidates of 7.1, scoring CVSS 7.1 with high confidentiality and availability impact. There is no public exploit identified at time of analysis and EPSS is negligible (0.02%), but a vendor fix is available across multiple stable branches.

Technical ContextAI

The bug lives in drivers/bluetooth/btmtk.c, the driver for MediaTek Bluetooth controllers that use the WMT (Wireless Management Tool) command/event protocol during firmware download and chip configuration. btmtk_usb_hci_wmt_sync() casts the raw socket buffer (SKB) payload of a WMT event response directly to struct btmtk_hci_wmt_evt (7 bytes) and, for the FUNC_CTRL path, struct btmtk_hci_wmt_evt_funcc (9 bytes) without first verifying the SKB actually holds that many bytes. This is a classic CWE-125 out-of-bounds read: a short firmware response leaves the struct fields pointing into uninitialized SKB tailroom, so the kernel dereferences memory beyond the valid buffer. The affected CPE is cpe:2.3:o:linux:linux_kernel across multiple version branches, including explicit 7.1:rc1 and 7.1:rc2 release candidates. The fix replaces the unchecked cast with skb_pull_data(), which validates that enough data exists and advances the pointer before the base WMT header and the additional FUNC_CTRL status bytes are accessed.

RemediationAI

Apply the vendor-released patch by upgrading to a kernel containing the fix: 7.1-rc3 or later on the mainline track, or the patched stable releases 6.12.88, 7.0.7, or 6.18.30 (and any later point release on your branch), which replace the unchecked SKB casts with skb_pull_data() validation; the upstream commits are at https://git.kernel.org/stable/c/70d37a8b9229e394cc17ddad47e90b81d80fcd09 and the related stable hashes (624fb79d, 634a4408, c411cf1b). If immediate patching is not possible, a targeted compensating control is to prevent the vulnerable code path from loading by blacklisting the btmtk module (echo 'blacklist btmtk' to a modprobe.d file) on hosts that do not require MediaTek Bluetooth - the trade-off is total loss of Bluetooth functionality for those adapters. Where Bluetooth is unused, disabling it in firmware/BIOS or physically removing the USB adapter also removes exposure. Track stable-tree updates at https://nvd.nist.gov/vuln/detail/CVE-2026-46140 for your distribution's backported package.

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2016-1646 HIGH POC
8.8
CVE-2025-5777 HIGH POC
7.5
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2017-11882 HIGH POC
7.8
CVE-2010-3333 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected

Share

CVE-2026-46140 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy