CVE-2026-64403
Received Received - Intake

BaseFortify

Publication date: 2026-07-25

Last updated on: 2026-07-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: validate option length before reading conf opt value l2cap_get_conf_opt() derives the option length from the attacker-controlled opt->len field and immediately dereferences opt->val (as u8, get_unaligned_le16() or get_unaligned_le32(), or a raw pointer for the default case) before any caller has confirmed that opt->len bytes are present in the buffer. The callers (l2cap_parse_conf_req(), l2cap_parse_conf_rsp() and l2cap_conf_rfc_get()) only detect a malformed option afterwards, once the running length has gone negative, by which point the out-of-bounds read has already executed. An existing post-hoc length check keeps the garbage value from being consumed, so this is not a data leak in the current control flow. It is still a validate-after-use ordering bug: up to 4 bytes are read past the end of the buffer before it is known to contain them, and it is fragile to future changes in the callers. Fix it at the source. Pass the end of the buffer into l2cap_get_conf_opt() and refuse to touch opt->val unless the full option (header + value) fits. Each caller computes an end pointer once before the loop and checks the return value directly instead of inferring the error from a negative length.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-25
Last Modified
2026-07-25
Generated
2026-07-25
AI Q&A
2026-07-25
EPSS Evaluated
N/A
NVD
CVE-2026-64403
EUVD
EUVD-2026-48947

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a buffer over-read vulnerability in the Linux kernel's Bluetooth L2CAP implementation. The function l2cap_get_conf_opt() reads option length from attacker-controlled data before validating if the buffer contains enough bytes. This leads to reading up to 4 extra bytes past the buffer end before detecting the error.

Detection Guidance

This vulnerability is specific to the Linux kernel's Bluetooth L2CAP implementation and requires kernel-level detection. There are no direct network or system commands to detect it as it is a logic flaw in the kernel code. The issue is resolved in patched kernel versions, so checking your kernel version against the fixed release is the primary detection method.

Impact Analysis

An attacker within Bluetooth range could exploit this to read small amounts of kernel memory. This might expose sensitive information but cannot be used to write data or execute arbitrary code. The impact is limited due to existing post-hoc checks preventing data leaks.

Compliance Impact

This vulnerability could potentially lead to unauthorized data exposure, which may violate GDPR's data protection principles or HIPAA's security requirements for protected health information. Organizations must patch to maintain compliance.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for CVE-2026-64403. This vulnerability is resolved by ensuring proper buffer length validation in the L2CAP code. No additional mitigation steps are required beyond applying the kernel patch.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64403. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart