CVE-2026-46140: linux Out-of-bounds Read
Vulnerability summary
CVE-2026-46140 is a high (CVSS 7.1) Out-of-bounds Read vulnerability in linux. EPSS estimates a 0.13% chance of exploitation in the next 30 days, higher than 2.3% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 22 · Related 22Timeline
- 28-05-2026PublishedVulnerability first disclosed.
- 04-07-2026Last modifiedVulnerability information updated.
Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btmtk: validate WMT event SKB length before struct access btmtk_usb_hci_wmt_sync() casts the WMT event response SKB data to struct btmtk_hci_wmt_evt (7 bytes) and struct btmtk_hci_wmt_evt_funcc (9 bytes) without first checking that the SKB contains enough data. A short firmware response causes out-of-bounds reads from SKB tailroom. Use skb_pull_data() to validate and advance past the base WMT event header. For the FUNC_CTRL case, pull the additional status field bytes before accessing them.
CVSS metrics
3 scores · 3 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated7.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
EPSS trend
Probability
0.13%
Chance of exploitation in the next 30 days
Percentile
2%
Versus all other CVEs
30-day change
0.00 pp
From 0.13% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Ubuntu140 products
- linuxAll versions (No fix recorded) | < 6.8.0-147.147 | < 7.0.0-28.28
- linux-allwinner-5.19All versions (No fix recorded)
- linux-awsAll versions (No fix recorded) | < 6.8.0-1067.70 | < 7.0.0-1009.9
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
Linux2 products
- linux≥ f0457842215438786e2e205ad06a4fbb8ab63cd0, < 36c85f7029484d5ede769f8873d16e9c8e35533c | ≥ d019930b0049fc2648a6b279893d8ad330596e81, < c411cf1bfde951cfa821809cf4020ba177f76e0c | ≥ d019930b0049fc2648a6b279893d8ad330596e81, < 624fb79dadc1b65757986a9d0fdde5c0cf3fe179 | ≥ d019930b0049fc2648a6b279893d8ad330596e81, < 70d37a8b9229e394cc17ddad47e90b81d80fcd09 | ≥ d019930b0049fc2648a6b279893d8ad330596e81, < 634a4408c0615c523cf7531790f4f14a422b9206 | ≥ 6.6.142, < 6.6.144 | 6.11
- linux_kernel≥ 6.6.142, < 6.7 | ≥ 6.11, < 6.12.88 | ≥ 6.13, < 6.18.30 | ≥ 6.19, < 7.0.7 | 7.1:rc1 | 7.1:rc2
Debian1 product
- linux< 6.12.88-1 | < 7.0.7-1
3 vendors · 143 products
