Skip to content
Fencer Vulns
no cvss —

CVE-2026-90090 json

Bluetooth: btmtksdio: Fix out-of-bounds DMA read in the TX path

published 2026-09-17 52 d ago modified 2026-10-19 21 d ago also EUVD-2026-81951

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 11%
public exploits
0
none known

Summary

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btmtksdio: Fix out-of-bounds DMA read in the TX path

btmtksdio_tx_packet() rounds the transfer size up to the SDIO block size of 256 bytes, but hands the host controller the SKB buffer as is:

err = sdio_writesb(bdev->func, MTK_REG_CTDR, skb->data, round_up(skb->len, MTK_SDIO_BLOCK_SIZE));

Only skb->len bytes hold packet data, so the controller reads up to 255 bytes of uninitialised memory and sends it to the device over the SDIO bus. Depending on how much tailroom slack the SKB allocation happens to carry, that read can also extend past the end of the buffer.

Compute the padded length up front, ensure the SKB has tailroom for it, and zero-fill the padding with skb_put_zero(). skb->len then covers the padding, so sdio_writesb() no longer needs to round up. byte_tx keeps counting the header and the payload only, and the error path restores the SKB so that the caller can requeue it.

Writing behind skb->tail is only safe because the driver owns the buffer, which "Bluetooth: btmtksdio: Take exclusive ownership of the SKB before TX" ensures.

Patch / fix

  • Linux Linux 6.1.188, 6.6.157, 6.12.110, 6.18.52, 7.2.6, 7.3
  • linux Debian 12 6.1.190-1
  • linux Debian 13 6.12.111-1
  • linux Debian 14 7.2.6-1
  • linux-6.12 Debian 12 6.12.111-1~deb12u1

debian advisories DEBIAN-CVE-2026-90090

  • linux Ubuntu 26.04 LTS 7.0.0-42.42
  • linux-aws Ubuntu 26.04 LTS 7.0.0-1016.17
  • linux-gcp Ubuntu 26.04 LTS 7.0.0-1016.18
  • linux-ibm Ubuntu 26.04 LTS 7.0.0-1017.17
  • linux-riscv Ubuntu 26.04 LTS 7.0.0-42.42.1
  • linux-oracle Ubuntu 26.04 LTS 7.0.0-1015.16
  • linux-hwe-7.0 Ubuntu 24.04 LTS 7.0.0-42.42~24.04.1
  • linux-oem-7.0 Ubuntu 26.04 LTS 7.0.0-1017.17

ubuntu advisories UBUNTU-CVE-2026-90090

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • kernel-source Linux Micro 6.0 6.4.0-159998.55.1
  • kernel-default Linux Micro 6.0 6.4.0-159998.55.1
  • kernel-kvmsmall Linux Micro 6.0 6.4.0-159998.55.1
  • kernel-default-base Linux Micro 6.0 6.4.0-159998.55.1.159998.21.42
  • kernel-64kb SLE Module for Basesystem 15 SP7 6.4.0-150700.53.90.1
  • kernel-syms SLE Module for Development Tools 15 SP7 6.4.0-150700.53.90.1
  • kernel-azure SLE Module for Public Cloud 15 SP7 6.4.0-150700.53.90.1
  • kernel-source SLE Module for Development Tools 15 SP7, SLE Module for Basesystem 15 SP7 6.4.0-150700.53.90.1

suse advisories SUSE-SU-2026:24550-1SUSE-SU-2026:5091-1

  • kernel-source openSUSE Tumbleweed 7.2.7-1.1

opensuse advisories openSUSE-SU-2026:11880-1

  • kernel Azure Linux 3.0 6.6.157.1-1

azure linux advisories AZL-102075

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-90090 updated cvss 5.5

kernel: Bluetooth: btmtksdio: Fix out-of-bounds DMA read in the TX path

  • Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-rt, kernel-core, kernel-tools, +29 more Red Hat Enterprise Linux 9 rv, perf, rtla, kernel, bpftool, libperf, +83 more Red Hat Enterprise Linux 10 kernel Red Hat OpenShift Container Platform 4 openshift/ose-rhel-coreos-8, openshift/ose-rhel-coreos-9
    +1 more products
    Red Hat OpenShift Container Platform 5 openshift/ose-rhel-coreos-9
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.21% chance of exploitation in the next 30 days, higher than 11% of all scored CVEs (FIRST EPSS, 2026-11-08).

Affected products

  • Linux Linux

Classification

Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.