Executive brief
A vulnerability in the Linux kernel's Bluetooth subsystem could allow an attacker within Bluetooth range to cause a system crash or potentially access sensitive memory. The issue occurs when the system processes specially crafted Bluetooth management packets before verifying their size. This could lead to service disruptions or unauthorized data access on affected devices.
Technical details
A vulnerability exists in the Linux kernel Bluetooth stack (net/bluetooth/hci_event.c) where hci_store_wake_reason() is invoked before proper bounds checking of HCI event packets. Specifically, the function is called immediately after stripping the HCI event header but before hci_event_func() enforces minimum payload lengths. This allows a malformed 'short' HCI event frame to reach the bacpy() function, resulting in an out-of-bounds read/copy. The fix involves moving the wake-reason storage logic into individual event handlers that have already performed length validation. Affected handlers include those for connection requests, connection completion, and various LE advertising reports.
Affected products
- Linux Linux Kernel 5.10 to 6.19.12
Timeline
- 2026-03-26: other: Patch authored
- 2026-05-01: advisory: CVE published