CVE-2026-90090

A flaw was found in the Linux kernel's Bluetooth MTK SDIO Secure Digital Input Output driver. The btmtksdiotxpacket function, which handles data transmission, incorrectly calculates the transfer size. This leads to an out-of-bounds read of uninitialized memory, which is then sent to the Bluetooth...

CVE-2026-90090

This CVE affects the Linux kernel Bluetooth btmtksdio driver. In the TX path, btmtksdio_tx_packet() rounds the transfer size up to the SDIO block size of 256 bytes but passes the raw SKB buffer to sdio_writesb(). Since only skb->len bytes hold actual packet data, the host controller reads up t...