CVE-2026-64573
Received Received - Intake

Buffer Overflow in Linux Kernel Bluetooth Driver

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: qca: fix NVM tag length underflow in TLV parser In the TLV_TYPE_NVM branch of qca_tlv_check_data() the tag loop bound is "while (idx < length - sizeof(struct tlv_type_nvm))". "length" is a signed int from the firmware TLV header and sizeof(struct tlv_type_nvm) is a size_t (12), so "length" is converted to size_t and any firmware-supplied "length" < 12 makes the subtraction wrap to a huge value. The loop body then reads a 12-byte struct tlv_type_nvm past the end of the short vmalloc'd firmware buffer (and the EDL_TAG_ID_* handlers can write past it). Rewrite the bound as "idx + sizeof(struct tlv_type_nvm) <= length"; both operands are non-negative, so it no longer underflows and a "length" too small for one record correctly skips the loop. BUG: KASAN: vmalloc-out-of-bounds in qca_download_firmware.isra.0 (drivers/bluetooth/btqca.c:421) Read of size 2 at addr ffffc900000e5004 by task kworker/u9:0/52 Workqueue: hci0 hci_power_on Call Trace: ... kasan_report (mm/kasan/report.c:595) qca_download_firmware.isra.0 (drivers/bluetooth/btqca.c:421 drivers/bluetooth/btqca.c:617) qca_uart_setup (drivers/bluetooth/btqca.c:948) qca_setup (drivers/bluetooth/hci_qca.c:2029) hci_uart_setup (drivers/bluetooth/hci_ldisc.c:438) hci_dev_open_sync (net/bluetooth/hci_sync.c:5227) hci_power_on (net/bluetooth/hci_core.c:920) process_one_work (kernel/workqueue.c:3322) worker_thread (kernel/workqueue.c:3486) kthread (kernel/kthread.c:436) ret_from_fork (arch/x86/kernel/process.c:158) ret_from_fork_asm (arch/x86/entry/entry_64.S:245)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-64573
EUVD
EUVD-2026-53267

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
qca bluetooth *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a Bluetooth driver (qca) where a signed integer underflow in the TLV parser allows reading or writing past the end of a firmware buffer. The issue occurs when the firmware-supplied length value is smaller than expected, causing the loop bound calculation to wrap around to a large positive number. This leads to out-of-bounds memory access in the qca_download_firmware function.

Detection Guidance

This vulnerability is specific to the Linux kernel's Bluetooth subsystem and may not have direct network detection methods. Check kernel logs for KASAN out-of-bounds errors related to qca_download_firmware or btqca.c. Use commands like dmesg | grep -i kasan or journalctl -k | grep -i kasan to inspect kernel logs for memory corruption events.

Impact Analysis

An attacker with proximity to the vulnerable device could exploit this to cause a system crash, execute arbitrary code, or escalate privileges. The flaw specifically affects Bluetooth functionality during firmware loading, potentially disrupting Bluetooth operations or compromising the system.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a memory safety issue in the Linux kernel's Bluetooth subsystem that could lead to out-of-bounds memory access. Compliance impacts would depend on how the vulnerability is exploited in a specific system or environment.

Mitigation Strategies

Update your Linux kernel to the latest stable version where this vulnerability is patched. If immediate patching is not possible, disable the affected Bluetooth module (qca) by blacklisting it or recompiling the kernel without QCA Bluetooth support. Monitor vendor advisories for firmware updates from Qualcomm Atheros.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64573. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart