CVE-2026-64126

Analyzed Analyzed - Analysis Complete

Bluetooth: MGMT Out-of-Bounds Read in Linux Kernel

Publication date: 2026-07-19

Last updated on: 2026-08-13

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: validate Add Extended Advertising Data length MGMT_OP_ADD_EXT_ADV_DATA is registered as a variable-length command, with MGMT_ADD_EXT_ADV_DATA_SIZE as the fixed header size. The handler then uses cp->adv_data_len and cp->scan_rsp_len to validate and copy cp->data, but it never checks that those bytes are part of the mgmt command payload. A short command can therefore make add_ext_adv_data() pass an out-of-bounds pointer into tlv_data_is_valid(). If the bytes beyond the command buffer are addressable, they can also be copied into the advertising instance as scan response data, where the caller can read them back via MGMT_OP_GET_ADV_INSTANCE. The trigger requires CAP_NET_ADMIN in the initial user namespace; KASAN reports an 8-byte slab-out-of-bounds read. Reject commands whose length does not match the fixed header plus both advertising data lengths before parsing cp->data.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-19

Last Modified

2026-08-13

Generated

2026-08-29

AI Q&A

2026-07-19

EPSS Evaluated

2026-08-28

NVD

CVE-2026-64126

EUVD

EUVD-2026-45811

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 5.16 (inc) to 6.1.175 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.92 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.34 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.0.11 (exc)
linux	linux_kernel	From 6.2 (inc) to 6.6.142 (exc)
linux	linux_kernel	From 5.11 (inc) to 5.15.210 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This is a Bluetooth vulnerability in the Linux kernel where a command handler for adding extended advertising data does not properly validate the length of input data. This can lead to reading out-of-bounds memory, potentially exposing sensitive information or causing system instability.

Detection Guidance

This vulnerability requires CAP_NET_ADMIN privileges and involves Bluetooth management operations. Detection may involve monitoring for unusual Bluetooth management commands or unexpected data reads via MGMT_OP_GET_ADV_INSTANCE. Check kernel logs for slab-out-of-bounds errors or KASAN reports related to Bluetooth operations.

Impact Analysis

If exploited, this flaw could allow an attacker with CAP_NET_ADMIN privileges to read sensitive memory contents or cause a denial-of-service condition. The impact depends on system configuration and whether exploitable memory is accessible.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it is a low-level Bluetooth stack issue in the Linux kernel. It requires CAP_NET_ADMIN privileges and involves out-of-bounds memory access, which is more relevant to system integrity than data protection regulations.

Mitigation Strategies

Apply the latest Linux kernel security patches that address this issue. Restrict CAP_NET_ADMIN privileges to trusted users. Monitor for suspicious Bluetooth management activity and disable Bluetooth if not required.

Hi! I’m here to help you understand CVE-2026-64126. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70