CVE-2026-46138 Bluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt

[
  {
    "product": "Linux",
    "vendor": "Linux",
    "defaultStatus": "unaffected",
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "programFiles": [
      "net/bluetooth/hci_event.c"
    ],
    "versions": [
      {
        "version": "a0bfde167b506423111ddb8cd71930497a40fc54",
        "lessThan": "6cb7f67bc28da787499291a562d49a084d9c90cd",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "a0bfde167b506423111ddb8cd71930497a40fc54",
        "lessThan": "22559ad7654f61727fc270ee4893da9f4b70cf17",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "a0bfde167b506423111ddb8cd71930497a40fc54",
        "lessThan": "77981a507aa0fc001dc37f0dd6631dd2042fed17",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "a0bfde167b506423111ddb8cd71930497a40fc54",
        "lessThan": "665da0baaf0396f9ed3c86ccb3955dcd0b73e774",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "a0bfde167b506423111ddb8cd71930497a40fc54",
        "lessThan": "5ddb8014261137cadaf83ab5617a588d80a22586",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "b475c1109251e30ec21fb574d72a1c71a4ab0039",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "2ccde10127447c1a5caad8469fede945bdb62fdf",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "6.4.16",
        "lessThan": "6.5",
        "status": "affected",
        "versionType": "semver"
      },
      {
        "version": "6.5.3",
        "lessThan": "6.6",
        "status": "affected",
        "versionType": "semver"
      }
    ]
  },
  {
    "product": "Linux",
    "vendor": "Linux",
    "defaultStatus": "affected",
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "programFiles": [
      "net/bluetooth/hci_event.c"
    ],
    "versions": [
      {
        "version": "6.6",
        "status": "affected"
      },
      {
        "version": "0",
        "lessThan": "6.6",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "6.6.140",
        "lessThanOrEqual": "6.6.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "6.12.88",
        "lessThanOrEqual": "6.12.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "6.18.30",
        "lessThanOrEqual": "6.18.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "7.0.7",
        "lessThanOrEqual": "7.0.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "7.1-rc3",
        "lessThanOrEqual": "*",
        "status": "unaffected",
        "versionType": "original_commit_for_fix"
      }
    ]
  }
]