https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 11:59:29 +0000 https://vulnerability.circl.lu/vuln/cve-2026-90257 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>Bluetooth: virtio_bt: avoid OOB read of build info string</p> <p>The virtbt_setup_zephyr() sends the Zephyr vendor command 0xfc08 (Read Build Information) and hands the response to bt_dev_info() and hci_set_fw_info() as a &#34;%s&#34; string starting at skb-&gt;data + 1, without checking the length. A backend that answers with status only leaves that pointer past the end of the received data, so the walk reads adjacent slab memory until it meets a NUL. Those bytes reach the kernel log and the firmware-info debugfs file.</p> <p>To fix this, print the string with a bounded &#34;%.*s&#34; limited to skb-&gt;len - 1. A short or unterminated response then prints as much as arrived instead of failing setup.</p> <p>This mirrors commit dd068ef04412 (&#34;Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup()&#34;), which fixed the identical pattern.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>Bluetooth: virtio_bt: avoid OOB read of build info string</p> <p>The virtbt_setup_zephyr() sends the Zephyr vendor command 0xfc08 (Read Build Information) and hands the response to bt_dev_info() and hci_set_fw_info() as a &#34;%s&#34; string starting at skb-&gt;data + 1, without checking the length. A backend that answers with status only leaves that pointer past the end of the received data, so the walk reads adjacent slab memory until it meets a NUL. Those bytes reach the kernel log and the firmware-info debugfs file.</p> <p>To fix this, print the string with a bounded &#34;%.*s&#34; limited to skb-&gt;len - 1. A short or unterminated response then prints as much as arrived instead of failing setup.</p> <p>This mirrors commit dd068ef04412 (&#34;Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup()&#34;), which fixed the identical pattern.</p> https://vulnerability.circl.lu/vuln/cve-2026-90257