CVE-2026-64403: Bluetooth: L2CAP: validate option length before reading conf opt value
Published Jul 25, 2026
·Updated
Bluetooth: L2CAP: validate option length before reading conf opt value
Affected Software
17 affected componentsFixes available
Linux Linux kernel
Microsoft azl3 kernel 6.6.144.1-1<6.6.145.2-1
6.6.145.2-1
Linux Linux kernel>=3.16.66<3.17
Linux Linux kernel>=3.18.138<3.19
Linux Linux kernel>=4.4.178<4.5
Linux Linux kernel>=4.9.167<4.10
Linux Linux kernel>=4.14.110<4.15
Linux Linux kernel>=4.19.33<4.20
Linux Linux kernel>=5.0.6<5.10.261
Linux Linux kernel>=5.11<5.15.212
Linux Linux kernel>=5.16<6.1.178
Linux Linux kernel>=6.2<6.6.145
Linux Linux kernel>=6.7<6.12.96
Linux Linux kernel>=6.13<6.18.39
Linux Linux kernel>=6.19<7.1.4
Linux Linux kernel=7.2-rc1
Linux Linux kernel=7.2-rc2
Remediation
Event History
Jul 25, 2026
CVE Published
via MITRE·08:50 AM
Data Sourced
via MITRE·08:50 AM
DescriptionSeverity
Data Sourced
via NVD·10:17 AM
RemedyDescriptionSeverityWeaknessAffected Software
Jul 26, 2026
Data Sourced
via Microsoft·08:04 AM
DescriptionSeverityWeaknessAffected Software
Updated
via Microsoft·08:04 AM
DescriptionSeverity
Frequently Asked Questions
1
What level of attacker access is required?
An attacker needs adjacent-network access via Bluetooth. No privileges or user interaction are required according to the CVSS vector.
2
Is this known to disclose kernel data in the current code path?
No. The existing post-hoc length check prevents the out-of-bounds value from being consumed, so the described current control flow is not considered a data leak.
3
Which products are identified as affected?
The affected software listed is the Linux kernel and Microsoft azl3 kernel 6.6.144.1-1.
4
What should teams do if they are affected?
Apply an available patch. The fix validates that the complete L2CAP configuration option is within the buffer before reading its value.