PT-2026-65214 · Linux · Linux
CVE-2026-64539
·
Published
2026-07-27
·
Updated
2026-07-27
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: eir: Fix stack OOB write when prepending the Flags AD
eir create adv data() builds the advertising data into a fixed-size
buffer ("size", 31 for the legacy path). It may prepend a 3-byte "Flags"
AD structure (LE AD NO BREDR on an LE-only controller) and then copies
the per-instance data without checking that it still fits:
memcpy(ptr, adv->adv data, adv->adv data len);tlv data max len() only reserves those 3 bytes when the user-supplied
flags carry a managed-flags bit, so an instance added with flags == 0 is
accepted with adv data len up to the full buffer. At advertise time the
flags are still prepended, and the memcpy() writes 3 + adv data len
bytes into the size-byte buffer:
BUG: KASAN: stack-out-of-bounds in eir create adv data (net/bluetooth/eir.c:301)
Write of size 31 at addr ffff88800a547bdc by task kworker/u9:0/65
Workqueue: hci0 hci cmd sync work
asan memcpy (mm/kasan/shadow.c:106)
eir create adv data (net/bluetooth/eir.c:301)
hci update adv data sync (net/bluetooth/hci sync.c:1310)
hci schedule adv instance sync (net/bluetooth/hci sync.c:1817)
hci cmd sync work (net/bluetooth/hci sync.c:332)
This frame has 1 object:
[32, 64) 'cp'
The "Flags" structure is added by the kernel, not requested by
userspace, so only prepend it when it fits together with the instance
advertising data; when there is no room for both, drop the flags rather
than the user-provided data.
Reachable by a local user with CAP NET ADMIN owning an LE-only
controller on the legacy advertising path.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux