CVE-2026-90251

A flaw was found in the Linux kernel's Bluetooth Microsoft (MSFT) driver. This vulnerability arises from insufficient validation of the evt_prefix_len field against the actual response length during the read_supported_features() operation. A malicious Bluetooth controller could exploit this by sending a crafted response, causing the kernel to copy and utilize arbitrary data from past the end of the intended response. This could lead to information disclosure or unexpected system behavior when processing incoming vendor events.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.