CVE-2026-90257

A flaw was found in the kernel's virtio_bt component. When processing responses to Zephyr vendor commands, the system fails to properly check the length of the received data. This can lead to an out-of-bounds read, where adjacent memory is accessed beyond the intended buffer. Consequently, sensitive bytes from memory may be exposed in kernel logs and debug files, leading to information disclosure.

A flaw was found in the Linux kernel's virtio_bt driver, affecting Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS 2. During device setup, virtbt_setup_zephyr() sends the Zephyr vendor command 0xfc08 (Read Build Information) and passes the response to bt_dev_info() and hci_set_fw_info() as an unbounded "%s" string starting at skb->data + 1 without checking the response length. A virtio Bluetooth backend that answers with a status-only response leaves that pointer past the end of the received data, so the kernel reads adjacent slab memory until it encounters a NUL byte, and the bytes read can be exposed in the kernel log and the firmware-info debugfs file. Red Hat rated this flaw MODERATE severity with a CVSS 3.1 score of 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H): exploitation requires local access within a guest that is configured with a virtio Bluetooth device whose backend returns a malformed response, and Red Hat's scoring reflects the availability impact of the out-of-bounds read rather than the upstream characterization of the memory disclosure. Red Hat Enterprise Linux 6, 7, 8, and 9, including their real-time kernel variants, and the OpenShift Container Platform RHCOS layers are not affected because the vulnerable code is not present in those releases. For the affected Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS 2 streams the fix is currently deferred; the residual risk until a fix is delivered is that a malicious virtio_bt backend could cause adjacent kernel slab memory contents to be disclosed through the kernel log or the debugfs firmware-info file.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.