CVE-2026-64539

Received Received - Intake

Bluetooth Stack OOB Write in Linux Kernel

Publication date: 2026-07-27

Last updated on: 2026-07-30

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: eir: Fix stack OOB write when prepending the Flags AD eir_create_adv_data() builds the advertising data into a fixed-size buffer ("size", 31 for the legacy path). It may prepend a 3-byte "Flags" AD structure (LE_AD_NO_BREDR on an LE-only controller) and then copies the per-instance data without checking that it still fits: memcpy(ptr, adv->adv_data, adv->adv_data_len); tlv_data_max_len() only reserves those 3 bytes when the user-supplied flags carry a managed-flags bit, so an instance added with flags == 0 is accepted with adv_data_len up to the full buffer. At advertise time the flags are still prepended, and the memcpy() writes 3 + adv_data_len bytes into the size-byte buffer: BUG: KASAN: stack-out-of-bounds in eir_create_adv_data (net/bluetooth/eir.c:301) Write of size 31 at addr ffff88800a547bdc by task kworker/u9:0/65 Workqueue: hci0 hci_cmd_sync_work __asan_memcpy (mm/kasan/shadow.c:106) eir_create_adv_data (net/bluetooth/eir.c:301) hci_update_adv_data_sync (net/bluetooth/hci_sync.c:1310) hci_schedule_adv_instance_sync (net/bluetooth/hci_sync.c:1817) hci_cmd_sync_work (net/bluetooth/hci_sync.c:332) This frame has 1 object: [32, 64) 'cp' The "Flags" structure is added by the kernel, not requested by userspace, so only prepend it when it fits together with the instance advertising data; when there is no room for both, drop the flags rather than the user-provided data. Reachable by a local user with CAP_NET_ADMIN owning an LE-only controller on the legacy advertising path.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-27

Last Modified

2026-07-30

Generated

2026-08-17

AI Q&A

2026-07-28

EPSS Evaluated

2026-08-15

NVD

CVE-2026-64539

EUVD

EUVD-2026-49590

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a stack out-of-bounds write vulnerability in the Linux kernel's Bluetooth subsystem. It occurs in the eir_create_adv_data() function when building advertising data for Bluetooth devices. The function uses a fixed-size buffer (31 bytes) but may prepend a 3-byte Flags structure without checking if there is enough space left for the user-provided advertising data. This can lead to a buffer overflow when the total data exceeds the buffer size.

Detection Guidance

This vulnerability is specific to the Linux kernel's Bluetooth subsystem and may not have direct network detection commands. Check kernel logs for stack out-of-bounds errors related to eir_create_adv_data or hci_update_adv_data_sync. Use 'dmesg | grep -i kasan' to look for KASAN errors. Ensure your kernel version is updated to a patched release.

Impact Analysis

This vulnerability can be exploited by a local user with CAP_NET_ADMIN privileges who owns an LE-only Bluetooth controller. The impact includes potential kernel memory corruption, crashes, or arbitrary code execution. It may also allow privilege escalation or denial-of-service attacks on affected systems.

Compliance Impact

This vulnerability is a stack out-of-bounds write in the Linux kernel's Bluetooth subsystem. It does not directly affect compliance with standards like GDPR or HIPAA, as those focus on data protection, privacy, and security controls rather than kernel-level memory corruption issues.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for this CVE. Restrict CAP_NET_ADMIN capabilities for untrusted users. Monitor Bluetooth-related kernel logs for suspicious activity. Disable legacy advertising paths if not required.

Hi! I’m here to help you understand CVE-2026-64539. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70