CVE Explorer

CVE-2026-46123

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: virtio_bt: clamp rx length before skb_put virtbt_rx_work() calls skb_put(skb, len) where len comes directly from virtqueue_get_buf() with no validation against the buffer we posted to the device. The RX skb is allocated in virtbt_add_inbuf() and exposed to virtio as exactly 1000 bytes via sg_init_one(). Checking len against skb_tailroom(skb) is not sufficient because alloc_skb() can leave more tailroom than the 100

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:b098dcb7b639234f6968e3f095eff4faf20c4a6ea1ba9f87590495034fb4f2ad

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Preserved source conflicts

No provider value was silently selected as the winner.

affected · 2 assertions

{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/bluetooth/virtio_bt.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"4236e55b2d9d1ffd3b4bdf8ebbb86e5a0a526b4a","status":"affected","version":"cf2719a21fdb9d4c8e9c834d279163609bef575d","versionType":"git"},{"lessThan":"fd91fa2678ab603dfb285416c1cf3843d7be1e41","status":"affected","version":"160fbcf3bfb93c3c086427f9f4c8bc70f217e9be","versionType":"git"},{"lessThan":"ed41c81d30b211a671667259c3b5feeba0e062d5","status":"affected","version":"160fbcf3bfb93c3c…

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:58c33e3f5aabf1cd08599fa8cdd4287af9d7587c3f76eea50e3132d42f5a8938 · sha256:d50975fbc4462016… · /containers/cna/affected/0

{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/bluetooth/virtio_bt.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.1"},{"lessThan":"6.1","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.140","versionType":"semver"},{"les…

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:58c33e3f5aabf1cd08599fa8cdd4287af9d7587c3f76eea50e3132d42f5a8938 · sha256:d50975fbc4462016… · /containers/cna/affected/1

Affected products and versions

2 source assertions

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:58c33e3f5aabf1cd08599fa8cdd4287af9d7587c3f76eea50e3132d42f5a8938 · sha256:d50975fbc4462016… · /containers/cna/affected/0

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:58c33e3f5aabf1cd08599fa8cdd4287af9d7587c3f76eea50e3132d42f5a8938 · sha256:d50975fbc4462016… · /containers/cna/affected/1

Provider-owned CVSS observations

1 source assertion

{"metric":{"baseScore":7.7,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","version":"3.1"},"metric_type":"cvssV3_1"}

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:58c33e3f5aabf1cd08599fa8cdd4287af9d7587c3f76eea50e3132d42f5a8938 · sha256:d50975fbc4462016… · /containers/cna/metrics/0/cvssV3_1

Source references

7 source assertions

{"url":"https://git.kernel.org/stable/c/21bd244b6de5d2fe1063c23acc93fbdd2b20d112"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:58c33e3f5aabf1cd08599fa8cdd4287af9d7587c3f76eea50e3132d42f5a8938 · sha256:d50975fbc4462016… · /containers/cna/references/6

{"url":"https://git.kernel.org/stable/c/4236e55b2d9d1ffd3b4bdf8ebbb86e5a0a526b4a"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:58c33e3f5aabf1cd08599fa8cdd4287af9d7587c3f76eea50e3132d42f5a8938 · sha256:d50975fbc4462016… · /containers/cna/references/0

{"url":"https://git.kernel.org/stable/c/6c1730099a6fc18b183bd6c1adad3b54adcaeda9"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:58c33e3f5aabf1cd08599fa8cdd4287af9d7587c3f76eea50e3132d42f5a8938 · sha256:d50975fbc4462016… · /containers/cna/references/3

{"url":"https://git.kernel.org/stable/c/b40cdd1b1370d76e9e760af4490cb4a351cceead"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:58c33e3f5aabf1cd08599fa8cdd4287af9d7587c3f76eea50e3132d42f5a8938 · sha256:d50975fbc4462016… · /containers/cna/references/4

{"url":"https://git.kernel.org/stable/c/e6b4296f170d949ebba937cf6a3f247ec9550d2c"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:58c33e3f5aabf1cd08599fa8cdd4287af9d7587c3f76eea50e3132d42f5a8938 · sha256:d50975fbc4462016… · /containers/cna/references/5

{"url":"https://git.kernel.org/stable/c/ed41c81d30b211a671667259c3b5feeba0e062d5"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:58c33e3f5aabf1cd08599fa8cdd4287af9d7587c3f76eea50e3132d42f5a8938 · sha256:d50975fbc4462016… · /containers/cna/references/2

{"url":"https://git.kernel.org/stable/c/fd91fa2678ab603dfb285416c1cf3843d7be1e41"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:58c33e3f5aabf1cd08599fa8cdd4287af9d7587c3f76eea50e3132d42f5a8938 · sha256:d50975fbc4462016… · /containers/cna/references/1

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer