CVE-2026-64126: Bluetooth: MGMT: validate Add Extended Advertising Data length
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: MGMT: validate Add Extended Advertising Data length
MGMTOPADDEXTADVDATA is registered as a variable-length command, with MGMTADDEXTADVDATASIZE as the fixed header size. The handler then uses cp->advdatalen and cp->scanrsplen to validate and copy cp->data, but it never checks that those bytes are part of the mgmt command payload.
A short command can therefore make addextadvdata() pass an out-of-bounds pointer into tlvdataisvalid(). If the bytes beyond the command buffer are addressable, they can also be copied into the advertising instance as scan response data, where the caller can read them back via MGMTOPGETADVINSTANCE. The trigger requires CAPNETADMIN in the initial user namespace; KASAN reports an 8-byte slab-out-of-bounds read.
Reject commands whose length does not match the fixed header plus both advertising data lengths before parsing cp->data.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
For MGMT_OP_ADD_EXT_ADV_DATA, reject commands whose length does not equal MGMT_ADD_EXT_ADV_DATA_SIZE plus both advertising data lengths before parsing cp->data.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64126?
CVE-2026-64126 has a high severity rating of 7.3 according to the CVSS 3.1 scoring system.
How do I fix CVE-2026-64126?
To fix CVE-2026-64126, it is recommended to update the Linux kernel to the patched version that addresses this vulnerability.
What systems are affected by CVE-2026-64126?
CVE-2026-64126 affects various versions of the Linux kernel that implement Bluetooth management commands.
What are the potential impacts of CVE-2026-64126?
CVE-2026-64126 could allow an attacker to exploit the Bluetooth management interface, potentially leading to denial of service or data leakage.
Is CVE-2026-64126 actively being exploited?
As of now, there have been no confirmed reports of active exploitation of CVE-2026-64126 in the wild.