Bluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt (Linux Linux)
En bref
- Source
- NVD
- EPSS
- EPSS 0.28 % · centile 20 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- Linux
- Statut NVD
- Undergoing Analysis
Rechercher sur…
Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt hci_le_create_big_complete_evt() iterates over BT_BOUND connections for a BIG handle using a while loop, accessing ev->bis_handle[i++] on each iteration. However, there is no check that i stays within ev->num_bis before the array access. When a controller sends a LE_Create_BIG_Complete event with fewer bis_handle entries than there are BT_BOUND connections for that BIG, or with num_bis=0, the loop reads beyond the valid bis_handle[] flex array into adjacent heap memory. Since the out-of-bounds values typically exceed HCI_CONN_HANDLE_MAX (0x0EFF), hci_conn_set_handle() rejects them and the connection remains in BT_BOUND state. The same connection is then found again by hci_conn_hash_lookup_big_state(), creating an infinite loop with hci_dev_lock held. Fix this by terminating the BIG if in case not all BIS could be setup properly.
Faiblesses (CWE)
- CWE-125 — Lecture hors limites
Références
- https://git.kernel.org/stable/c/6cb7f67bc28da787499291a562d49a084d9c90cd
- https://git.kernel.org/stable/c/22559ad7654f61727fc270ee4893da9f4b70cf17
- https://git.kernel.org/stable/c/77981a507aa0fc001dc37f0dd6631dd2042fed17
- https://git.kernel.org/stable/c/665da0baaf0396f9ed3c86ccb3955dcd0b73e774
- https://git.kernel.org/stable/c/5ddb8014261137cadaf83ab5617a588d80a22586
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | HIGH 8.1 | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H | Linux |
| CVSS 3.1 | HIGH 8.1 | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H | NVD · 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (Secondary) |
Références européennes
- ENISA EUVD · EUVD-2026-32765
- GCVE · GCVE-0-2026-46138
Avis du CERT-FR
- CERTFR-2026-AVI-1252 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1229 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1162 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1066 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1064 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0954 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0927 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0926 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0731 — Multiples vulnérabilités dans les produits Microsoft · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.4.16 < 6.5cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.5.3 < 6.6.140cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.7 < 6.12.88cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.13 < 6.18.30cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.19 < 7.0.7cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| Linux · Linux | affected a0bfde167b506423111ddb8cd71930497a40fc54 < 6cb7f67bc28da787499291a562d49a084d9c90cd ; affected a0bfde167b506423111ddb8cd71930497a40fc54 < 22559ad7654f61727fc270ee4893da9f4b70cf17 ; affected a0bfde167b506423111ddb8cd71930497a40fc54 < 77981a507aa0fc001dc37f0dd6631dd2042fed17 ; affected a0bfde167b506423111ddb8cd71930497a40fc54 < 665da0baaf0396f9ed3c86ccb3955dcd0b73e774 ; affected a0bfde167b506423111ddb8cd71930497a40fc54 < 5ddb8014261137cadaf83ab5617a588d80a22586 ; affected b475c1109251e30ec21fb574d72a1c71a4ab0039 |
| Linux · Linux | affected 6.6 ; unaffected 0 < 6.6 ; unaffected 6.6.140 ≤ 6.6.* ; unaffected 6.12.88 ≤ 6.12.* ; unaffected 6.18.30 ≤ 6.18.* ; unaffected 7.0.7 ≤ 7.0.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |