---
id: CVE-2026-46138
title: >-
  Bluetooth: hci_event: Fix OOB read and infinite loop in
  hci_le_create_big_complete_evt
summary: >-
  In the Linux kernel, the following vulnerability has been resolved:


  Bluetooth: hci_event: Fix OOB read and infinite loop in
  hci_le_create_big_complete_evt


  hci_le_create_big_complete_evt() iterates over BT_BOUND connections for

  a BIG ha…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= a0bfde167b506423111ddb8cd71930497a40fc54 <
    6cb7f67bc28da787499291a562d49a084d9c90cd
  - >-
    Linux >= a0bfde167b506423111ddb8cd71930497a40fc54 <
    22559ad7654f61727fc270ee4893da9f4b70cf17
  - >-
    Linux >= a0bfde167b506423111ddb8cd71930497a40fc54 <
    77981a507aa0fc001dc37f0dd6631dd2042fed17
  - >-
    Linux >= a0bfde167b506423111ddb8cd71930497a40fc54 <
    665da0baaf0396f9ed3c86ccb3955dcd0b73e774
  - >-
    Linux >= a0bfde167b506423111ddb8cd71930497a40fc54 <
    5ddb8014261137cadaf83ab5617a588d80a22586
  - Linux b475c1109251e30ec21fb574d72a1c71a4ab0039
  - Linux 2ccde10127447c1a5caad8469fede945bdb62fdf
  - Linux >= 6.4.16 < 6.5
  - Linux >= 6.5.3 < 6.6
  - Linux 6.6
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-16T15:20:20.651932Z'
published: '2026-05-28'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:31:04.856Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-46138'
references:
  - url: 'https://git.kernel.org/stable/c/6cb7f67bc28da787499291a562d49a084d9c90cd'
  - url: 'https://git.kernel.org/stable/c/22559ad7654f61727fc270ee4893da9f4b70cf17'
  - url: 'https://git.kernel.org/stable/c/77981a507aa0fc001dc37f0dd6631dd2042fed17'
  - url: 'https://git.kernel.org/stable/c/665da0baaf0396f9ed3c86ccb3955dcd0b73e774'
  - url: 'https://git.kernel.org/stable/c/5ddb8014261137cadaf83ab5617a588d80a22586'
tags:
  - cve.org
epss: 0.00405
epssPercentile: 0.33202
ingestedAt: '2026-10-16T17:24:46.709Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt

hci_le_create_big_complete_evt() iterates over BT_BOUND connections for
a BIG handle using a while loop, accessing ev->bis_handle[i++] on each
iteration.  However, there is no check that i stays within ev->num_bis
before the array access.

When a controller sends a LE_Create_BIG_Complete event with fewer
bis_handle entries than there are BT_BOUND connections for that BIG,
or with num_bis=0, the loop reads beyond the valid bis_handle[] flex
array into adjacent heap memory.  Since the out-of-bounds values
typically exceed HCI_CONN_HANDLE_MAX (0x0EFF), hci_conn_set_handle()
rejects them and the connection remains in BT_BOUND state.  The same
connection is then found again by hci_conn_hash_lookup_big_state(),
creating an infinite loop with hci_dev_lock held.

Fix this by terminating the BIG if in case not all BIS could be setup
properly.

## Affected

- `Linux >= a0bfde167b506423111ddb8cd71930497a40fc54 < 6cb7f67bc28da787499291a562d49a084d9c90cd`
- `Linux >= a0bfde167b506423111ddb8cd71930497a40fc54 < 22559ad7654f61727fc270ee4893da9f4b70cf17`
- `Linux >= a0bfde167b506423111ddb8cd71930497a40fc54 < 77981a507aa0fc001dc37f0dd6631dd2042fed17`
- `Linux >= a0bfde167b506423111ddb8cd71930497a40fc54 < 665da0baaf0396f9ed3c86ccb3955dcd0b73e774`
- `Linux >= a0bfde167b506423111ddb8cd71930497a40fc54 < 5ddb8014261137cadaf83ab5617a588d80a22586`
- `Linux b475c1109251e30ec21fb574d72a1c71a4ab0039`
- `Linux 2ccde10127447c1a5caad8469fede945bdb62fdf`
- `Linux >= 6.4.16 < 6.5`
- `Linux >= 6.5.3 < 6.6`
- `Linux 6.6`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.