CVE-2026-89583: Bluetooth: eir: Fix OOB read in eir_get_service_data()
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: eir: Fix OOB read in eirgetservicedata()
eirgetservicedata() walks the advertising data for a Service Data field with a matching UUID. On a mismatch it advances:
eir += dlen; eirlen -= dlen;
eirgetdata() reports dlen as the field's data length, but the field spans dlen + 2 bytes once its length and type bytes count, and more when non-Service-Data fields were skipped to reach it. The pointer lands correctly on the next field. eirlen does not, and the shortfall compounds across fields until eirgetdata() reads the length and type bytes of a "field" past the end of the buffer.
For an ISO broadcast sink that buffer is hcon->leperadvdata[], filled from the periodic advertising reports of a remote broadcaster. A PA payload packed with mismatching Service Data fields walks off the array into the rest of struct hciconn. A drifted field that matches the BAA UUID puts those bytes in isopi(sk)->base, where user space reads them back with getsockopt(BTISOBASE).
Recompute eirlen from the end of the buffer each iteration.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.188 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.157 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.109 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.50 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.4
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
The affected path is an ISO broadcast sink processing periodic advertising data from a remote Bluetooth broadcaster. Exposure therefore requires use of Bluetooth ISO broadcast reception and receipt of periodic advertising reports.
What does an attacker need to exploit it?
An attacker needs to act as a remote broadcaster and provide a periodic advertising payload containing mismatching Service Data fields. The malformed field layout causes the advertising-data parser's remaining-length tracking to drift past the buffer.
What is the impact of successful exploitation?
The parser can read beyond the periodic advertising data array and into adjacent hci_conn memory. If the drifted field matches the BAA UUID, those bytes can be placed in the ISO socket base value and read by user space through getsockopt(BT_ISO_BASE).
How can exposure be reduced before applying the fix?
Avoid using ISO broadcast sink functionality or processing periodic advertising data from untrusted remote broadcasters until the fix is available. The supplied fix recomputes the remaining buffer length from the buffer end on every parsing iteration.