CVE-2026-64573: Bluetooth: qca: fix NVM tag length underflow in TLV parser
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: qca: fix NVM tag length underflow in TLV parser
In the TLVTYPENVM branch of qcatlvcheckdata() the tag loop bound is "while (idx < length - sizeof(struct tlvtypenvm))". "length" is a signed int from the firmware TLV header and sizeof(struct tlvtypenvm) is a sizet (12), so "length" is converted to sizet and any firmware-supplied "length" < 12 makes the subtraction wrap to a huge value. The loop body then reads a 12-byte struct tlvtypenvm past the end of the short vmalloc'd firmware buffer (and the EDLTAGID handlers can write past it).
Rewrite the bound as "idx + sizeof(struct tlvtypenvm) <= length"; both operands are non-negative, so it no longer underflows and a "length" too small for one record correctly skips the loop.
BUG: KASAN: vmalloc-out-of-bounds in qcadownloadfirmware.isra.0 (drivers/bluetooth/btqca.c:421) Read of size 2 at addr ffffc900000e5004 by task kworker/u9:0/52 Workqueue: hci0 hcipoweron Call Trace: ... kasanreport (mm/kasan/report.c:595) qcadownloadfirmware.isra.0 (drivers/bluetooth/btqca.c:421 drivers/bluetooth/btqca.c:617) qcauartsetup (drivers/bluetooth/btqca.c:948) qcasetup (drivers/bluetooth/hciqca.c:2029) hciuartsetup (drivers/bluetooth/hcildisc.c:438) hcidevopensync (net/bluetooth/hcisync.c:5227) hcipoweron (net/bluetooth/hcicore.c:920) processonework (kernel/workqueue.c:3322) workerthread (kernel/workqueue.c:3486) kthread (kernel/kthread.c:436) retfromfork (arch/x86/kernel/process.c:158) retfromforkasm (arch/x86/entry/entry64.S:245)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In the TLV_TYPE_NVM branch of qca_tlv_check_data() rewrite the loop bound from 'idx < length - sizeof(struct tlv_type_nvm)' to 'idx + sizeof(struct tlv_type_nvm) <= length' to prevent signed length underflow when 'length' is too small.
Linux kernel (drivers/bluetooth/btqca.c) qca_tlv_check_data() TLV_TYPE_NVM loop bound condition = Replace while condition with (idx + sizeof(struct tlv_type_nvm) <= length) - Operational
Rebuild and redeploy the updated kernel containing the btqca TLV parser fix (drivers/bluetooth/btqca.c) so the out-of-bounds read/write is eliminated.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64573?
The severity of CVE-2026-64573 is classified as risk 37.
How do I fix CVE-2026-64573?
To fix CVE-2026-64573, you should update your Linux kernel to the patched version provided by your distribution.
What impact does CVE-2026-64573 have on Bluetooth functionality?
CVE-2026-64573 may lead to potential vulnerabilities in Bluetooth operations, specifically with the parsing of NVM tags.
Which Linux kernel versions are affected by CVE-2026-64573?
CVE-2026-64573 affects specific versions of the Linux kernel that handle Wireless communication processing.
When was CVE-2026-64573 published?
CVE-2026-64573 was published on August 5, 2026.