CVE-2026-46332

In the Linux kernel, the following vulnerability has been resolved: greybus: gb-beagleplay: bound bootloader receive buffering cc1352_bootloader_rx() appends each serdev chunk into the fixed rx_buffer before parsing bootloader packets. The helper can keep leftover bytes between callbacks and may receive multiple packets in one callback, so a single count value is not constrained by one packet length. Check that the incoming chunk fits in the remaining receive buffer space before memcpy(). If it does not, drop the staged data and consume the bytes instead of overflowing rx_buffer.

CVSS v3 8.0 HIGH

8.0^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.1 / Impact : 5.9

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://git.kernel.org/stable/c/0339a746ff7cd3f9d10f565e89c99dc93191e58d	Patch
https://git.kernel.org/stable/c/1214bf28965ceaf584fb20d357731264dd2e10e1	Patch
https://git.kernel.org/stable/c/663c2728a6d0f781044431111b53a27f71027e48	Patch
https://git.kernel.org/stable/c/fb91d4e49fcbea0b5091394ac5b8f7d4124265c3	Patch

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::

History

No history.

Information

Published : 2026-06-09 14:16

Updated : 2026-07-23 08:10

NVD link : CVE-2026-46332

Mitre link : CVE-2026-46332

CVE.ORG link : CVE-2026-46332

JSON object : View

Products Affected

linux

linux_kernel

CWE

CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

{"id": "CVE-2026-46332", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.0, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.1}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "0cf7befa3ea2e7284d8ba5b8f45a546865b09edb", "lessThan": "663c2728a6d0f781044431111b53a27f71027e48", "versionType": "git"}, {"status": "affected", "version": "0cf7befa3ea2e7284d8ba5b8f45a546865b09edb", "lessThan": "fb91d4e49fcbea0b5091394ac5b8f7d4124265c3", "versionType": "git"}, {"status": "affected", "version": "0cf7befa3ea2e7284d8ba5b8f45a546865b09edb", "lessThan": "0339a746ff7cd3f9d10f565e89c99dc93191e58d", "versionType": "git"}, {"status": "affected", "version": "0cf7befa3ea2e7284d8ba5b8f45a546865b09edb", "lessThan": "1214bf28965ceaf584fb20d357731264dd2e10e1", "versionType": "git"}], "programFiles": ["drivers/greybus/gb-beagleplay.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.12"}, {"status": "unaffected", "version": "0", "lessThan": "6.12", "versionType": "semver"}, {"status": "unaffected", "version": "6.12.86", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.27", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.0.4", "versionType": "semver", "lessThanOrEqual": "7.0.*"}, {"status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/greybus/gb-beagleplay.c"], "defaultStatus": "affected"}]}], "published": "2026-06-09T14:16:42.817", "references": [{"url": "https://git.kernel.org/stable/c/0339a746ff7cd3f9d10f565e89c99dc93191e58d", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/1214bf28965ceaf584fb20d357731264dd2e10e1", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/663c2728a6d0f781044431111b53a27f71027e48", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/fb91d4e49fcbea0b5091394ac5b8f7d4124265c3", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-120"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngreybus: gb-beagleplay: bound bootloader receive buffering\n\ncc1352_bootloader_rx() appends each serdev chunk into the fixed\nrx_buffer before parsing bootloader packets. The helper can keep\nleftover bytes between callbacks and may receive multiple packets in one\ncallback, so a single count value is not constrained by one packet\nlength.\n\nCheck that the incoming chunk fits in the remaining receive buffer space\nbefore memcpy(). If it does not, drop the staged data and consume the\nbytes instead of overflowing rx_buffer."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ngreybus: gb-beagleplay: almacenamiento en b\u00fafer de recepci\u00f3n del cargador de arranque limitado\n\ncc1352_bootloader_rx() a\u00f1ade cada fragmento de serdev en el rx_buffer fijo antes de analizar los paquetes del cargador de arranque. La funci\u00f3n auxiliar puede mantener bytes sobrantes entre retrollamadas y puede recibir m\u00faltiples paquetes en una retrollamada, por lo que un \u00fanico valor de conteo no est\u00e1 limitado por la longitud de un paquete.\n\nComprobar que el fragmento entrante cabe en el espacio restante del b\u00fafer de recepci\u00f3n antes de memcpy(). Si no es as\u00ed, descartar los datos preparados y consumir los bytes en lugar de desbordar el rx_buffer."}], "lastModified": "2026-07-23T08:10:00.137", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A868CB0E-7563-461B-9681-F1CE80B353EE", "versionEndExcluding": "6.12.86", "versionStartIncluding": "6.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A10AC84F-C058-47D5-85B4-E6E51A613B74", "versionEndExcluding": "6.18.27", "versionStartIncluding": "6.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CDB78D6D-22C3-4154-B0D0-94AF1CE5C2E3", "versionEndExcluding": "7.0.4", "versionStartIncluding": "6.19"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}