PT-2026-64628 · Linux · Linux
CVE-2026-64407
·
Published
2026-07-25
·
Updated
2026-07-25
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp recv fw req v3()
During the v3 firmware download the controller sends a v3 data req with a
32 bit offset and a 16 bit len. nxp recv fw req v3() checks only the lower
bound of the offset and then sends firmware from that offset.
nxpdev->fw dnld v3 offset = offset - nxpdev->fw v3 offset correction;
serdev device write buf(nxpdev->serdev, nxpdev->fw->data +
nxpdev->fw dnld v3 offset, len);
Nothing checks that fw dnld v3 offset + len stays within nxpdev->fw->size,
so a controller that asks for an offset or length past the firmware image
makes the driver read past the end of nxpdev->fw->data and send that
memory back over UART.
nxp recv fw req v1() already bounds the same write. Add the equivalent
check to the v3 path, reject the request when it falls outside the firmware
image, and zero len on the error path so the fw v3 prev sent bookkeeping at
free skb stays consistent.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux