Veille CVE

‹ Retour à la liste

CVE-2026-46140

7.1 Élevée

Publiée le 28/05/2026 à 12:16 · Modifiée le 04/07/2026 à 14:16 · Analyse NVD en cours · Source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btmtk: validate WMT event SKB length before struct access btmtk_usb_hci_wmt_sync() casts the WMT event response SKB data to struct btmtk_hci_wmt_evt (7 bytes) and struct btmtk_hci_wmt_evt_funcc (9 bytes) without first checking that the SKB contains enough data. A short firmware response causes out-of-bounds reads from SKB tailroom. Use skb_pull_data() to validate and advance past the base WMT event header. For the FUNC_CTRL case, pull the additional status field bytes before accessing them.

Traduire en français

Produits concernés

Scores CVSS

VersionScoreSourceVecteur
3.1 7.1 Élevée nvd@nist.gov (NVD) CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Faiblesses (CWE)

Références

Ailleurs