CVE-2026-64549

Received Received - Intake

Buffer Overflow in Linux Kernel Bluetooth bpa10x Driver

Publication date: 2026-07-27

Last updated on: 2026-07-27

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup() bpa10x_setup() sends the vendor command 0xfc0e and passes the response to bt_dev_info() and hci_set_fw_info() as a "%s" string starting at skb->data + 1, without checking the length: bt_dev_info(hdev, "%s", (char *)(skb->data + 1)); hci_set_fw_info(hdev, "%s", skb->data + 1); A device that returns a one-byte response (status only) leaves skb->data + 1 past the end of the data, and the %s walk reads adjacent slab memory until it meets a NUL. The same happens when the payload is not NUL-terminated within skb->len. The out-of-bounds bytes end up in the kernel log and the firmware-info debugfs file. Print the revision string with a bounded "%.*s" limited to skb->len - 1 instead. This keeps the string readable for well-behaved devices while never reading past the received data, and does not fail setup, so a device returning a short or unterminated response keeps working.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-27

Last Modified

2026-07-27

Generated

2026-08-17

AI Q&A

2026-07-28

EPSS Evaluated

2026-08-15

NVD

CVE-2026-64549

EUVD

EUVD-2026-49600

Affected Vendors & Products

Vendor	Product	Version / Range
linux_kernel	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a vulnerability in the Linux kernel's Bluetooth subsystem. It involves an out-of-bounds (OOB) read in the bpa10x_setup() function when handling vendor command responses. The function reads a revision string from a Bluetooth device without properly checking the response length, potentially exposing adjacent memory contents in kernel logs or firmware-info debugfs files.

Detection Guidance

This vulnerability is specific to the Linux kernel's Bluetooth bpa10x driver and does not have a direct network detection method. It may be detected by checking kernel logs for out-of-bounds memory reads related to Bluetooth operations or examining firmware-info debugfs entries for unexpected data.

Impact Analysis

This vulnerability could allow an attacker with Bluetooth device access to read sensitive kernel memory contents. This might expose system information or other data stored in adjacent memory. It primarily affects systems using the bpa10x Bluetooth driver.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or other major standards and regulations. It is a local kernel memory disclosure issue in Bluetooth driver code that could expose small amounts of adjacent slab memory in kernel logs or debugfs files. Such exposure is unlikely to result in the unauthorized disclosure of regulated data like personal health information or personally identifiable information.

Mitigation Strategies

Update your Linux kernel to a patched version that includes the fix for this vulnerability. Monitor kernel logs for Bluetooth-related errors and ensure your Bluetooth firmware is from a trusted source.

Hi! I’m here to help you understand CVE-2026-64549. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70