CVE-2026-90089 - Vulnerability Details

- Bluetooth: btnxpuart: Validate the FW dump header length

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btnxpuart: Validate the FW dump header length

nxp_process_fw_dump() pulls the ACL header off the frame and then reads
seq_num and buf_len from a struct nxp_fw_dump_hdr placed at skb->data,
without checking that the ACL payload is long enough to contain it.

h4_recv_buf() collects HCI_ACL_HDR_SIZE bytes of header followed by the
number of payload bytes named in that header, so skb->len is 4 + dlen
with dlen supplied by the controller and possibly smaller than the 8
byte dump header, or zero. A short frame with connection handle 0xfff
therefore reads both fields from beyond the received data.

Beyond the read itself, buf_len is what terminates a dump: a value of
zero makes the driver call hci_devcd_complete() and reset the
controller, so a truncated frame can end a dump early.

Use skb_pull_data() to validate and pull the FW dump header before
accessing its fields. Warn and reject the chunk if the header is
truncated.

Published: 2026-09-17

Score: 7.1 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability resides in the Bluetooth driver for NXP devices and allows the kernel to read fields beyond the end of a received ACL packet. A malicious controller can send a truncated frame whose payload is smaller than the 8‑byte firmware dump header, causing the driver to read from memory that is not part of the packet. The read is not used for malicious execution, but the unmarshaled value of buf_len determines when the driver aborts a firmware dump. If buf_len is zero, the driver invokes a reset of the Bluetooth controller, thereby disrupting all Bluetooth services on the host.

Affected Systems

All Linux kernel builds that include the Bluetooth btnxpuart driver and have not applied the patch commit referenced in the advisory are affected. The specific kernel versions impacted are not listed; the effect applies to any kernel prior to the commit that added skb_pull_data() validation.

Risk and Exploitability

The CVSS score of 7.1 indicates medium severity. The EPSS score is under 1% and the vulnerability is not listed in CISA KEV, indicating a low probability of exploitation. Nevertheless, the attack requires an attacker to be able to send arbitrary HCI commands over Bluetooth to the target device. No prerequisites beyond Bluetooth connectivity are documented, so a local or remote attacker with L2CAP or HCI access could potentially trigger the exploit.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`998e447f443f138c90faa6ff3845082af419070e`	affected	< a644b8df94966b672ac656577df98bd01bc88393
`998e447f443f138c90faa6ff3845082af419070e`	affected	< 22d419db7f9a01bea22cfcf66774d2b2fd4bb354
`998e447f443f138c90faa6ff3845082af419070e`	affected	< 060fa7592bdc043a93b6b7870f5b8551206d315d

Linux

affected

Version	Status	Constraints
`6.15`	affected	—
`0`	unaffected	< 6.15
`6.18.52`	unaffected	≤ 6.18.*
`7.2.6`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[998e447f443f138c90faa6ff3845082af419070e,a644b8df94966b672ac656577df98bd01bc88393)`	affected	code_commit	—
`[998e447f443f138c90faa6ff3845082af419070e,22d419db7f9a01bea22cfcf66774d2b2fd4bb354)`	affected	code_commit	—
`[998e447f443f138c90faa6ff3845082af419070e,060fa7592bdc043a93b6b7870f5b8551206d315d)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.15`	affected	generic	—
`[0,6.15)`	unaffected	generic	—
`[6.18.52,6.19.0)`	unaffected	semver	—
`[7.2.6,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply a Linux kernel update that includes the btnxpuart firmware dump header validation patch.
If an immediate kernel update is not possible, disable or restrict Bluetooth firmware dump functionality or consider disabling the Bluetooth subsystem while the vulnerability is unpatched.
Monitor Bluetooth traffic for anomalous short ACL frames or unexpected controller resets and apply remediation promptly.

Generated by OpenCVE AI on September 20, 2026 at 03:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00331.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/060fa7592bdc043a93b6b7870f5b8551206d315d
https://git.kernel.org/stable/c/22d419db7f9a01bea22cfcf66774d2b2fd4bb354
https://git.kernel.org/stable/c/a644b8df94966b672ac656577df98bd01bc88393

History

Sun, 20 Sep 2026 03:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-119 CWE-20

Fri, 18 Sep 2026 21:30:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.1, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H'}`

Thu, 17 Sep 2026 16:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btnxpuart: Validate the FW dump header length nxp_process_fw_dump() pulls the ACL header off the frame and then reads seq_num and buf_len from a struct nxp_fw_dump_hdr placed at skb->data, without checking that the ACL payload is long enough to contain it. h4_recv_buf() collects HCI_ACL_HDR_SIZE bytes of header followed by the number of payload bytes named in that header, so skb->len is 4 + dlen with dlen supplied by the controller and possibly smaller than the 8 byte dump header, or zero. A short frame with connection handle 0xfff therefore reads both fields from beyond the received data. Beyond the read itself, buf_len is what terminates a dump: a value of zero makes the driver call hci_devcd_complete() and reset the controller, so a truncated frame can end a dump early. Use skb_pull_data() to validate and pull the FW dump header before accessing its fields. Warn and reject the chunk if the header is truncated.
Title		Bluetooth: btnxpuart: Validate the FW dump header length
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/060fa7592bdc043a93b6b7870f5b8551206d315d https://git.kernel.org/stable/c/22d419db7f9a01bea22cfcf66774d2b2fd4bb354 https://git.kernel.org/stable/c/a644b8df94966b672ac656577df98bd01bc88393

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-17T16:06:04.201Z

Updated: 2026-09-18T17:52:55.438Z

Reserved: 2026-09-11T19:38:34.786Z

Link: CVE-2026-90089

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-17T17:17:00.067

Modified: 2026-09-18T18:17:41.060

Link: CVE-2026-90089

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-09-20T03:30:13Z

Weaknesses

CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-20
Improper Input Validation

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object