CVE-2026-90089 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: btnxpuart: Validate the FW dump header length
nxp_process_fw_dump() pulls the ACL header off the frame and then reads seq_num and buf_len from a struct nxp_fw_dump_hdr placed at skb->data, without checking that the ACL payload is long enough to contain it.
h4_recv_buf() collects HCI_ACL_HDR_SIZE bytes of header followed by the number of payload bytes named in that header, so skb->len is 4 + dlen with dlen supplied by the controller and possibly smaller than the 8 byte dump header, or zero. A short frame with connection handle 0xfff therefore reads both fields from beyond the received data.
Beyond the read itself, buf_len is what terminates a dump: a value of zero makes the driver call hci_devcd_complete() and reset the controller, so a truncated frame can end a dump early.
Use skb_pull_data() to validate and pull the FW dump header before accessing its fields. Warn and reject the chunk if the header is truncated.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/17/2026
The Linux kernel Bluetooth subsystem contains a critical out-of-bounds read vulnerability within the NXP UART driver, specifically in the function responsible for processing firmware dumps. This flaw arises from an insufficient validation of packet lengths before accessing structured data fields. The nxp_process_fw_dump() routine is designed to extract information from incoming HCI frames by pulling the ACL header and then interpreting a struct nxp_fw_dump_hdr located at the start of the payload buffer, referenced as skb->data. However, the implementation fails to verify that the available packet length is sufficient to contain this eight-byte structure. This oversight allows an attacker or a malfunctioning Bluetooth controller to trigger memory reads beyond the bounds of the allocated network buffer if the incoming frame is truncated or unusually short.
The root cause lies in how data is collected and processed by the underlying H4 protocol handler, h4_recv_buf(). This function retrieves four bytes for the HCI ACL header followed by dlen payload bytes as specified in that header. Consequently, the total length of the socket buffer skb->len becomes four plus dlen. If a controller sends a frame with a connection handle indicating an invalid or special context and provides a small value for dlen, the resulting packet may be shorter than the eight bytes required by the firmware dump header structure. When nxp_process_fw_dump() proceeds to read the sequence number and buffer length fields from this undersized payload without prior validation, it performs unbounded memory reads. This behavior constitutes an out-of-bounds read vulnerability that can expose kernel memory contents or lead to undefined behavior depending on what data resides immediately after the packet in memory.
The operational impact of this vulnerability extends beyond simple information disclosure. The field buf_len extracted from the malformed header is used as a termination condition for the firmware dump process. Specifically, if buf_len evaluates to zero, the driver invokes hci_devcd_complete() and resets the Bluetooth controller. Therefore, an attacker capable of injecting or manipulating short HCI frames can force this early termination sequence. This results in a denial of service by disrupting ongoing firmware updates or diagnostic operations and potentially causing instability within the Bluetooth subsystem. The reset action may also interfere with other concurrent network activities relying on stable connectivity states, amplifying the severity of the disruption beyond the immediate driver context.
To mitigate this risk, the vulnerability is addressed by enforcing strict length validation before any structural access occurs. The fix utilizes skb_pull_data() to ensure that the entire firmware dump header can be safely pulled from the socket buffer prior to accessing its members such as seq_num and buf_len. If the packet does not contain enough data to form a complete eight-byte header, the driver now issues a warning and rejects the chunk rather than proceeding with unsafe memory access. This defensive programming approach aligns with industry standards for input validation in network drivers. From a classification perspective, this flaw corresponds to CWE-125 Out-of-bounds Read, as it involves reading data beyond the intended buffer boundary. Additionally, because it allows an attacker to disrupt service through malformed inputs, it relates to ATT&CK techniques involving resource exhaustion or denial of service via protocol manipulation. System administrators should ensure that kernel updates incorporating this patch are applied promptly to prevent exploitation in environments where untrusted Bluetooth devices may interact with the system.