🟡 Medium | Source: Microsoft Security Response Center
CVE-2026-46140 is a vulnerability in the Linux kernel’s Bluetooth subsystem, specifically in the btmtk driver, where WMT event socket buffer (SKB) lengths are not validated before accessing internal data structures. This could allow an attacker to trigger out-of-bounds memory access, potentially leading to information disclosure or system instability. The issue is relevant to Azure environments running Linux-based virtual machines or container workloads that expose Bluetooth functionality.
Security Architect’s Take: Review any Azure Linux VM or container workloads that use Bluetooth hardware or emulated Bluetooth interfaces and ensure the underlying kernel is patched; for most cloud-native workloads Bluetooth is not present, but verify this assumption — particularly in edge or IoT deployments on Azure.
Original advisory: CVE-2026-46140 Bluetooth: btmtk: validate WMT event SKB length before struct access