CVE-2026-46123

A flaw was found in the Linux kernel's virtio Bluetooth (virtio_bt) driver. A malicious or faulty virtualized Bluetooth device could send a specially crafted message with an incorrect length. This could lead to the kernel reading uninitialized memory, potentially exposing sensitive information from the kernel's memory to the attacker.

virtio_bt RX handling trusted the used length reported by the virtio backend and passed it to skb_put() even though only 1000 bytes were exposed to the device. A malicious or buggy backend can report a length greater than 1000 but still within skb tailroom, causing the skb to include uninitialized guest kernel heap bytes that were never written by the device. A zero length completion can also reach packet handling and make the driver read an uninitialized packet type byte. For the CVSS the PR:N is used because the attacker does not need privileges inside the guest when controlling the virtio backend, but this is not network reachable and requires a malicious or compromised host or device model. Impact is mainly confidentiality exposure and possible denial of service, with no shown write primitive or direct privilege escalation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.