Improper Validation of Specified Quantity in Input in Linux kernel - CVE-2026-90251

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU151229

Improper Validation of Specified Quantity in Input in Linux kernel - CVE-2026-90251

Published: September 18, 2026


Vulnerability identifier: #VU151229
CSH Severity: Low
CVSS v4: 0 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-90251
CWE-ID: CWE-1284
Exploitation vector: Adjecent network
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to cause the kernel to read data beyond the controller response.

The vulnerability exists due to improper validation of an event prefix length in the Bluetooth MSFT read_supported_features() handler when handling an MSFT read supported features response from a Bluetooth controller. A remote attacker can provide a response whose declared event-prefix length exceeds its actual length to cause the kernel to read data beyond the controller response.

The copied data is later used to match incoming vendor events.


Affected software

Linux kernel
Debian Linux
SUSE Linux Micro Extras
SUSE Linux Micro
Ubuntu
linux (Ubuntu package)
linux-kvm (Ubuntu package)
linux-aws (Ubuntu package)
linux-gcp (Ubuntu package)
linux-azure (Ubuntu package)
linux-oracle (Ubuntu package)
linux-lowlatency (Ubuntu package)
linux-gke (Ubuntu package)
linux-aws-5.15 (Ubuntu package)
linux-lowlatency-hwe-5.15 (Ubuntu package)
linux-hwe-5.15 (Ubuntu package)
linux-fips (Ubuntu package)
linux-azure-5.15 (Ubuntu package)
linux-realtime (Ubuntu package)
linux-nvidia (Ubuntu package)
linux-ibm-5.15 (Ubuntu package)
linux-intel-iotg (Ubuntu package)
linux-nvidia-tegra-igx (Ubuntu package)
linux-nvidia-tegra (Ubuntu package)
linux-gkeop (Ubuntu package)
linux-azure-fde-5.15 (Ubuntu package)
linux-ibm (Ubuntu package)
linux-intel-iotg-5.15 (Ubuntu package)
linux-oracle-5.15 (Ubuntu package)
linux-gcp-5.15 (Ubuntu package)
linux-nvidia-tegra-5.15 (Ubuntu package)
linux-azure-fde (Ubuntu package)
linux-intel-iot-realtime (Ubuntu package)
linux-gcp-fips (Ubuntu package)
linux-aws-fips (Ubuntu package)
linux-azure-fips (Ubuntu package)
linux-hwe-7.0 (Ubuntu package)
linux-oem-7.0 (Ubuntu package)
kernel-default-devel-debuginfo
kernel-default-debugsource
kernel-obs-build-debugsource
kernel-obs-build
kernel-syms
kernel-default-devel
kernel-64kb-devel
kernel-64kb-debugsource
kernel-default
kernel-64kb
linux (Debian package)

How to mitigate CVE-2026-90251

Install security update from vendor's repository.

linux (Ubuntu package) - addressed in versions 5.15.0-202.212, 7.0.0-42.42
linux-kvm (Ubuntu package) - update to 5.15.0-1111.116
linux-aws (Ubuntu package) - addressed in versions 5.15.0-1119.126, 7.0.0-1016.17
linux-gcp (Ubuntu package) - addressed in versions 5.15.0-1120.130, 7.0.0-1016.18
linux-azure (Ubuntu package) - update to 5.15.0-1125.134
linux-oracle (Ubuntu package) - addressed in versions 5.15.0-1116.122, 7.0.0-1015.16
linux-lowlatency (Ubuntu package) - update to 5.15.0-197.207
linux-gke (Ubuntu package) - update to 5.15.0-1115.121
linux-aws-5.15 (Ubuntu package) - update to 5.15.0-1119.126~20.04.1
linux-lowlatency-hwe-5.15 (Ubuntu package) - update to 5.15.0-197.207~20.04.1
linux-hwe-5.15 (Ubuntu package) - update to 5.15.0-202.212~20.04.1
linux-fips (Ubuntu package) - update to 5.15.0-202.212+fips1
linux-azure-5.15 (Ubuntu package) - update to 5.15.0-1125.134~20.04.1
linux-realtime (Ubuntu package) - update to 5.15.0-1118.127
linux-nvidia (Ubuntu package) - update to 5.15.0-1114.115
linux-ibm-5.15 (Ubuntu package) - update to 5.15.0-1113.117~20.04.1
linux-intel-iotg (Ubuntu package) - update to 5.15.0-1114.120
linux-nvidia-tegra-igx (Ubuntu package) - update to 5.15.0-1059.59
linux-nvidia-tegra (Ubuntu package) - update to 5.15.0-1070.72
linux-gkeop (Ubuntu package) - update to 5.15.0-1102.110
linux-azure-fde-5.15 (Ubuntu package) - update to 5.15.0-1124.133~20.04.1
linux-ibm (Ubuntu package) - addressed in versions 5.15.0-1113.117, 7.0.0-1017.17
linux-intel-iotg-5.15 (Ubuntu package) - update to 5.15.0-1114.120~20.04.1
linux-oracle-5.15 (Ubuntu package) - update to 5.15.0-1116.122~20.04.1
linux-gcp-5.15 (Ubuntu package) - update to 5.15.0-1120.130~20.04.1
linux-nvidia-tegra-5.15 (Ubuntu package) - update to 5.15.0-1070.72~20.04.1
linux-azure-fde (Ubuntu package) - update to 5.15.0-1124.133
linux-intel-iot-realtime (Ubuntu package) - update to 5.15.0-1111.115
linux-gcp-fips (Ubuntu package) - update to 5.15.0-1120.130+fips1
linux-aws-fips (Ubuntu package) - update to 5.15.0-1119.126+fips1
linux-azure-fips (Ubuntu package) - update to 5.15.0-1125.134+fips1
linux-hwe-7.0 (Ubuntu package) - update to 7.0.0-42.42~24.04.1
linux-oem-7.0 (Ubuntu package) - update to 7.0.0-1017.17
kernel-default-devel-debuginfo - update to 6.4.0-159998.55.1
kernel-default-debugsource - update to 6.4.0-159998.55.1
kernel-obs-build-debugsource - update to 6.4.0-159998.55.1
kernel-obs-build - update to 6.4.0-159998.55.1
kernel-syms - update to 6.4.0-159998.55.1
kernel-default-devel - update to 6.4.0-159998.55.1
kernel-64kb-devel - update to 6.4.0-159998.55.1
kernel-64kb-debugsource - update to 6.4.0-159998.55.1
kernel-default - update to 6.4.0-159998.55.1
kernel-64kb - update to 6.4.0-159998.55.1
linux (Debian package) - update to 6.12.111-1

External References

Related Security Bulletins