{"id":25498,"date":"2026-09-18T04:31:28","date_gmt":"2026-09-17T20:31:28","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-90089"},"modified":"2026-09-18T04:31:28","modified_gmt":"2026-09-17T20:31:28","slug":"cve-2026-90089","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-90089","title":{"rendered":"CVE-2026-90089 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btnxpuart:"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>Bluetooth: btnxpuart: Validate the FW dump header length<\/p>\n<p>nxp_process_fw_dump() pulls the ACL header off the frame and then reads<br \/>\nseq_num and buf_len from a struct nxp_fw_dump_hdr placed at skb-&gt;data,<br \/>\nwithout checking that the ACL payload is long enough to contain it.<\/p>\n<p>h4_recv_buf() collects HCI_ACL_HDR_SIZE bytes of header followed by the<br \/>\nnumber of payload bytes named in that header, so skb-&gt;len is 4 + dlen<br \/>\nwith dlen supplied by the controller and possibly smaller than the 8<br \/>\nbyte dump header, or zero. A short frame with connection handle 0xfff<br \/>\ntherefore reads both fields from beyond the received data.<\/p>\n<p>Beyond the read itself, buf_len is what terminates a dump: a value of<br \/>\nzero makes the driver call hci_devcd_complete() and reset the<br \/>\ncontroller, so a truncated frame can end a dump early.<\/p>\n<p>Use skb_pull_data() to validate and pull the FW dump header before<br \/>\naccessing its fields. Warn and reject the chunk if the header is<br \/>\ntruncated.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>Bluetooth: btnxpuart: Validate the FW dump header length<\/p>\n<p>nxp_process_fw_dump() pulls the ACL header off the frame and then reads<br \/>\ns<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25498","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25498","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25498"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25498"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25498"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}