PT-2026-64628 · Linux · Linux

CVE-2026-64407 · Publicado 2026-07-25 · Atualizado 2026-07-25

NVD

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp recv fw req v3()

During the v3 firmware download the controller sends a v3 data req with a 32 bit offset and a 16 bit len. nxp recv fw req v3() checks only the lower bound of the offset and then sends firmware from that offset.

nxpdev->fw dnld v3 offset = offset - nxpdev->fw v3 offset correction; serdev device write buf(nxpdev->serdev, nxpdev->fw->data + nxpdev->fw dnld v3 offset, len);

Nothing checks that fw dnld v3 offset + len stays within nxpdev->fw->size, so a controller that asks for an offset or length past the firmware image makes the driver read past the end of nxpdev->fw->data and send that memory back over UART.

nxp recv fw req v1() already bounds the same write. Add the equivalent check to the v3 path, reject the request when it falls outside the firmware image, and zero len on the error path so the fw v3 prev sent bookkeeping at free skb stays consistent.

Identificadores relacionados

CVE-2026-64407

Produtos afetados

Linux

Referências · 6

• https://git.kernel.org/stable/c/21e60eb4d95854196e7c0e77383f35e7ac95df61 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-64407 · Nota de Segurança
• https://git.kernel.org/stable/c/2a68a773089204af1c8581dc79668b775418c5ee · Nota
• https://git.kernel.org/stable/c/badff6c3bed8923a1257a853f137d447976eec30 · Nota
• https://git.kernel.org/stable/c/441088792ffec3ca01f4efe2934060570eb11eb8 · Nota
• https://git.kernel.org/stable/c/49bcb39e3a041ce26021f77971eaccb49a275118 · Nota