CVE-2026-46138

A flaw was found in the Linux kernel's Bluetooth subsystem, specifically within the hci_le_create_big_complete_evt function. A remote attacker, by sending a specially crafted LE_Create_BIG_Complete event from a malicious Bluetooth controller, could trigger an out-of-bounds read and an infinite loop. This vulnerability can lead to a Denial of Service (DoS) due to the system becoming unresponsive while holding the hci_dev_lock.

A malformed LE Create BIG Complete event can make the Bluetooth HCI event handler read past the valid bis_handle flex array when fewer BIS handles are present than bound BIG connections. The out-of-bounds value is then used as an HCI handle and may be rejected, leaving the connection in BT_BOUND state and causing the same connection to be found again in a loop while hci_dev_lock is held. For the CVSS the PR:N is used because a malicious or faulty controller response does not require privileges on the victim once the affected controller path is reachable. The issue is firmware or controller mediated and is not clearly a normal remote Bluetooth packet parsing bug. Impact is mainly denial of service through a stuck HCI event path or kernel lockup, with no demonstrated information disclosure or privilege escalation primitive.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.