{"id":25666,"date":"2026-09-18T04:31:42","date_gmt":"2026-09-17T20:31:42","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-90257"},"modified":"2026-09-18T04:31:42","modified_gmt":"2026-09-17T20:31:42","slug":"cve-2026-90257","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-90257","title":{"rendered":"CVE-2026-90257 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: virtio_bt:"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>Bluetooth: virtio_bt: avoid OOB read of build info string<\/p>\n<p>The virtbt_setup_zephyr() sends the Zephyr vendor command 0xfc08 (Read<br \/>\nBuild Information) and hands the response to bt_dev_info() and<br \/>\nhci_set_fw_info() as a &#8220;%s&#8221; string starting at skb-&gt;data + 1, without<br \/>\nchecking the length. A backend that answers with status only leaves that<br \/>\npointer past the end of the received data, so the walk reads adjacent<br \/>\nslab memory until it meets a NUL. Those bytes reach the kernel log and<br \/>\nthe firmware-info debugfs file.<\/p>\n<p>To fix this, print the string with a bounded &#8220;%.*s&#8221; limited to<br \/>\nskb-&gt;len &#8211; 1. A short or unterminated response then prints as much as<br \/>\narrived instead of failing setup.<\/p>\n<p>This mirrors commit dd068ef04412 (&#8220;Bluetooth: bpa10x: avoid OOB read of<br \/>\nrevision string in bpa10x_setup()&#8221;), which fixed the identical pattern.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>Bluetooth: virtio_bt: avoid OOB read of build info string<\/p>\n<p>The virtbt_setup_zephyr() sends the Zephyr vendor command 0xfc08 (Read<br \/>\nB<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25666","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25666","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25666"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25666"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25666"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}