PT-2026-61443 · Linux · Linux

CVE-2026-64126 · Published 2026-07-19 · Updated 2026-07-19

NVD

CVSS v3.1

7.3

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: MGMT: validate Add Extended Advertising Data length

MGMT OP ADD EXT ADV DATA is registered as a variable-length command, with MGMT ADD EXT ADV DATA SIZE as the fixed header size. The handler then uses cp->adv data len and cp->scan rsp len to validate and copy cp->data, but it never checks that those bytes are part of the mgmt command payload.

A short command can therefore make add ext adv data() pass an out-of-bounds pointer into tlv data is valid(). If the bytes beyond the command buffer are addressable, they can also be copied into the advertising instance as scan response data, where the caller can read them back via MGMT OP GET ADV INSTANCE. The trigger requires CAP NET ADMIN in the initial user namespace; KASAN reports an 8-byte slab-out-of-bounds read.

Reject commands whose length does not match the fixed header plus both advertising data lengths before parsing cp->data.

Fix

Related Identifiers

CVE-2026-64126

Affected Products

Linux

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-64126 · Security Note
• https://git.kernel.org/stable/c/0bc1a5a69f541859293d79db72bd7854ac48df51 · Note
• https://git.kernel.org/stable/c/14b01b9cba04e6ce82825f68fc4c4322fa4ffa43 · Note
• https://git.kernel.org/stable/c/a6c75a3fad226ccbd8ef9110dee87c92c299f2ab · Note
• https://git.kernel.org/stable/c/d3f7d17960ed50df3a6709c5158caff989c8c905 · Note
• https://git.kernel.org/stable/c/a143ce77a5292f2c9285137433d879ce71d190a7 · Note
• https://git.kernel.org/stable/c/0d5104390b445e7bd664ad583837e4c04d892c9d · Note
• https://git.kernel.org/stable/c/f1febe93ef075314615f970a87681d9ab86691d1 · Note