CVE-2026-64126
Received Received - Intake

Bluetooth: MGMT Out-of-Bounds Read in Linux Kernel

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: validate Add Extended Advertising Data length MGMT_OP_ADD_EXT_ADV_DATA is registered as a variable-length command, with MGMT_ADD_EXT_ADV_DATA_SIZE as the fixed header size. The handler then uses cp->adv_data_len and cp->scan_rsp_len to validate and copy cp->data, but it never checks that those bytes are part of the mgmt command payload. A short command can therefore make add_ext_adv_data() pass an out-of-bounds pointer into tlv_data_is_valid(). If the bytes beyond the command buffer are addressable, they can also be copied into the advertising instance as scan response data, where the caller can read them back via MGMT_OP_GET_ADV_INSTANCE. The trigger requires CAP_NET_ADMIN in the initial user namespace; KASAN reports an 8-byte slab-out-of-bounds read. Reject commands whose length does not match the fixed header plus both advertising data lengths before parsing cp->data.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-64126
EUVD
EUVD-2026-45811

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Bluetooth vulnerability in the Linux kernel where a command handler for adding extended advertising data does not properly validate the length of input data. This can lead to reading out-of-bounds memory, potentially exposing sensitive information or causing system instability.

Detection Guidance

This vulnerability requires CAP_NET_ADMIN privileges and involves Bluetooth management operations. Detection may involve monitoring for unusual Bluetooth management commands or unexpected data reads via MGMT_OP_GET_ADV_INSTANCE. Check kernel logs for slab-out-of-bounds errors or KASAN reports related to Bluetooth operations.

Impact Analysis

If exploited, this flaw could allow an attacker with CAP_NET_ADMIN privileges to read sensitive memory contents or cause a denial-of-service condition. The impact depends on system configuration and whether exploitable memory is accessible.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it is a low-level Bluetooth stack issue in the Linux kernel. It requires CAP_NET_ADMIN privileges and involves out-of-bounds memory access, which is more relevant to system integrity than data protection regulations.

Mitigation Strategies

Apply the latest Linux kernel security patches that address this issue. Restrict CAP_NET_ADMIN privileges to trusted users. Monitor for suspicious Bluetooth management activity and disable Bluetooth if not required.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64126. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart