CVE-2026-90089 (GCVE-0-2026-90089)

Vulnerability from cvelistv5 – Published: 2026-09-17 16:06 – Updated: 2026-09-18 17:52
VLAI
Title
Bluetooth: btnxpuart: Validate the FW dump header length
Summary
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btnxpuart: Validate the FW dump header length nxp_process_fw_dump() pulls the ACL header off the frame and then reads seq_num and buf_len from a struct nxp_fw_dump_hdr placed at skb->data, without checking that the ACL payload is long enough to contain it. h4_recv_buf() collects HCI_ACL_HDR_SIZE bytes of header followed by the number of payload bytes named in that header, so skb->len is 4 + dlen with dlen supplied by the controller and possibly smaller than the 8 byte dump header, or zero. A short frame with connection handle 0xfff therefore reads both fields from beyond the received data. Beyond the read itself, buf_len is what terminates a dump: a value of zero makes the driver call hci_devcd_complete() and reset the controller, so a truncated frame can end a dump early. Use skb_pull_data() to validate and pull the FW dump header before accessing its fields. Warn and reject the chunk if the header is truncated.
Severity
7.1 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 998e447f443f138c90faa6ff3845082af419070e , < a644b8df94966b672ac656577df98bd01bc88393 (git)
Affected: 998e447f443f138c90faa6ff3845082af419070e , < 22d419db7f9a01bea22cfcf66774d2b2fd4bb354 (git)
Affected: 998e447f443f138c90faa6ff3845082af419070e , < 060fa7592bdc043a93b6b7870f5b8551206d315d (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.15
Unaffected: 0 , < 6.15 (semver)
Unaffected: 6.18.52 , ≤ 6.18.* (semver)
Unaffected: 7.2.6 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/bluetooth/btnxpuart.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a644b8df94966b672ac656577df98bd01bc88393",
              "status": "affected",
              "version": "998e447f443f138c90faa6ff3845082af419070e",
              "versionType": "git"
            },
            {
              "lessThan": "22d419db7f9a01bea22cfcf66774d2b2fd4bb354",
              "status": "affected",
              "version": "998e447f443f138c90faa6ff3845082af419070e",
              "versionType": "git"
            },
            {
              "lessThan": "060fa7592bdc043a93b6b7870f5b8551206d315d",
              "status": "affected",
              "version": "998e447f443f138c90faa6ff3845082af419070e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/bluetooth/btnxpuart.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.15"
            },
            {
              "lessThan": "6.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.52",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btnxpuart: Validate the FW dump header length\n\nnxp_process_fw_dump() pulls the ACL header off the frame and then reads\nseq_num and buf_len from a struct nxp_fw_dump_hdr placed at skb-\u003edata,\nwithout checking that the ACL payload is long enough to contain it.\n\nh4_recv_buf() collects HCI_ACL_HDR_SIZE bytes of header followed by the\nnumber of payload bytes named in that header, so skb-\u003elen is 4 + dlen\nwith dlen supplied by the controller and possibly smaller than the 8\nbyte dump header, or zero. A short frame with connection handle 0xfff\ntherefore reads both fields from beyond the received data.\n\nBeyond the read itself, buf_len is what terminates a dump: a value of\nzero makes the driver call hci_devcd_complete() and reset the\ncontroller, so a truncated frame can end a dump early.\n\nUse skb_pull_data() to validate and pull the FW dump header before\naccessing its fields. Warn and reject the chunk if the header is\ntruncated."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The malformed nxp_fw_dump_hdr is taken from HCI ACL frames with connection handle 0xFFF. Those frames are assembled by h4_recv_buf() from UART bytes in btnxpuart_receive_buf() and dispatched by nxp_recv_acl_pkt() into nxp_process_fw_dump(). A nearby attacker who induces an NXP firmware dump over the air supplies that ACL dump chunk; Bluetooth range is Adjacent.\nAC:L - nxp_process_fw_dump() loads seq_num and buf_len after skb_pull_data() of only the 4-byte HCI ACL header. h4_recv_buf() delivers any dlen the controller advertised, including zero, so one handle-0xFFF ACL with dlen\u003c8 deterministically over-reads with no race or uninfluenced layout.\nPR:N - nxp_recv_acl_pkt() and nxp_process_fw_dump() run on the serdev RX path with no pairing, HCI authentication, or capability check; handle 0xFFF dump chunks are consumed before they reach the normal HCI ACL stack.\nUI:N - btnxpuart_receive_buf() always passes complete H4 ACL frames to nxp_recv_acl_pkt(); no user must pair, confirm a prompt, or write the HCI coredump sysfs entry for a dump chunk to be parsed.\nS:U - The over-read, hci_devcd_init/append/complete dump state, and nxp_set_ind_reset() controller reset all stay in the host kernel\u0027s btnxpuart/HCI authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:L - After pulling the ACL header, the driver loads the 8-byte nxp_fw_dump_hdr (seq_num and buf_len) from skb-\u003edata even when skb-\u003elen is 0\u20137. That is a strictly bounded 8-byte over-read of the H4 ACL skb tailroom allocated at HCI_MAX_FRAME_SIZE, and those fields are never copied to userspace.\nI:N - The path only reads seq_num/buf_len to decide dump start/complete and does not write past the skb; hci_devcd_append() copies only skb-\u003elen valid bytes, so there is no OOB write or control-flow hijack primitive.\nA:H - When the over-read buf_len is 0, nxp_process_fw_dump() calls hci_devcd_complete() and nxp_set_ind_reset(), which injects HCI_EV_HARDWARE_ERROR 0xb0 (BTNXPUART_IR_HW_ERR) and runs the independent-reset path (nxp_hw_err \u2192 HCI_NXP_IND_RESET), taking the Bluetooth controller down; a truncated handle-0xFFF frame can repeat this at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T17:52:55.438Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a644b8df94966b672ac656577df98bd01bc88393"
        },
        {
          "url": "https://git.kernel.org/stable/c/22d419db7f9a01bea22cfcf66774d2b2fd4bb354"
        },
        {
          "url": "https://git.kernel.org/stable/c/060fa7592bdc043a93b6b7870f5b8551206d315d"
        }
      ],
      "title": "Bluetooth: btnxpuart: Validate the FW dump header length",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-90089",
    "datePublished": "2026-09-17T16:06:04.201Z",
    "dateReserved": "2026-09-11T19:38:34.786Z",
    "dateUpdated": "2026-09-18T17:52:55.438Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-90089",
      "date": "2026-09-25",
      "epss": "0.00331",
      "percentile": "0.2361"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/bluetooth/btnxpuart.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "a644b8df94966b672ac656577df98bd01bc88393",
                    "status": "affected",
                    "version": "998e447f443f138c90faa6ff3845082af419070e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "22d419db7f9a01bea22cfcf66774d2b2fd4bb354",
                    "status": "affected",
                    "version": "998e447f443f138c90faa6ff3845082af419070e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "060fa7592bdc043a93b6b7870f5b8551206d315d",
                    "status": "affected",
                    "version": "998e447f443f138c90faa6ff3845082af419070e",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/bluetooth/btnxpuart.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.15"
                  },
                  {
                    "lessThan": "6.15",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.52",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btnxpuart: Validate the FW dump header length\n\nnxp_process_fw_dump() pulls the ACL header off the frame and then reads\nseq_num and buf_len from a struct nxp_fw_dump_hdr placed at skb-\u003edata,\nwithout checking that the ACL payload is long enough to contain it.\n\nh4_recv_buf() collects HCI_ACL_HDR_SIZE bytes of header followed by the\nnumber of payload bytes named in that header, so skb-\u003elen is 4 + dlen\nwith dlen supplied by the controller and possibly smaller than the 8\nbyte dump header, or zero. A short frame with connection handle 0xfff\ntherefore reads both fields from beyond the received data.\n\nBeyond the read itself, buf_len is what terminates a dump: a value of\nzero makes the driver call hci_devcd_complete() and reset the\ncontroller, so a truncated frame can end a dump early.\n\nUse skb_pull_data() to validate and pull the FW dump header before\naccessing its fields. Warn and reject the chunk if the header is\ntruncated."
          }
        ],
        "id": "CVE-2026-90089",
        "lastModified": "2026-09-18T18:17:41.060",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "ADJACENT_NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "LOW",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 4.2,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-17T17:17:00.067",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/060fa7592bdc043a93b6b7870f5b8551206d315d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/22d419db7f9a01bea22cfcf66774d2b2fd4bb354"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/a644b8df94966b672ac656577df98bd01bc88393"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.