CVE-2026-64407: Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3()
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxprecvfwreqv3()
During the v3 firmware download the controller sends a v3datareq with a 32 bit offset and a 16 bit len. nxprecvfwreqv3() checks only the lower bound of the offset and then sends firmware from that offset.
nxpdev->fwdnldv3offset = offset - nxpdev->fwv3offsetcorrection; serdevdevicewritebuf(nxpdev->serdev, nxpdev->fw->data + nxpdev->fwdnldv3offset, len);
Nothing checks that fwdnldv3offset + len stays within nxpdev->fw->size, so a controller that asks for an offset or length past the firmware image makes the driver read past the end of nxpdev->fw->data and send that memory back over UART.
nxprecvfwreqv1() already bounds the same write. Add the equivalent check to the v3 path, reject the request when it falls outside the firmware image, and zero len on the error path so the fwv3prevsent bookkeeping at freeskb stays consistent.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Apply the kernel driver fix for the Bluetooth `btnxpuart` vulnerability by ensuring `nxp_recv_fw_req_v3()` validates that `fw_dnld_v3_offset + len` stays within `nxpdev->fw->size`; reject out-of-range v3 firmware download requests and zero `len` on the error path so firmware read cannot go past the end of `nxpdev->fw->data`.
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attacker needs local access and low privileges, as reflected by the CVSS vector AV:L/PR:L/UI:N. Exploitation does not require user interaction.
What condition triggers the out-of-bounds read?
A Bluetooth controller must send a v3 firmware-download request with an offset or length that causes the requested range to extend beyond the loaded firmware image. The vulnerable driver then reads past the end of the firmware buffer and transmits the resulting memory contents over UART.
What is the impact of a successful exploit?
The issue can disclose memory beyond the firmware image through the UART transfer and can affect availability. The supplied CVSS vector rates confidentiality and availability impact as high, with no integrity impact.
What does the fix change?
The fix adds an upper-bound check for the requested firmware offset and length in the v3 download path. Requests outside the firmware image are rejected, and the error path clears the length value to keep download bookkeeping consistent.