CVE-2026-90251

A flaw was found in the Linux kernel's Bluetooth Microsoft MSFT driver. This vulnerability arises from insufficient validation of the evtprefixlen field against the actual response length during the readsupportedfeatures operation. A malicious Bluetooth controller could exploit this by sending a...

Linux Distros Unpatched Vulnerability : CVE-2026-90251

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: MSFT: validate evtprefixlen against the response length readsupportedfeatures only checks that the response covers the fixed part of struct...

CVE-2026-90251 Bluetooth: MSFT: validate evt_prefix_len against the response length

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MSFT: validate evtprefixlen against the response length readsupportedfeatures only checks that the response covers the fixed part of struct msftrpreadsupportedfeatures, which is 11 bytes: if skb-len evtprefixlen is an...