Executive brief
A vulnerability in the Linux kernel's Bluetooth subsystem could allow a local user to crash the system or potentially execute unauthorized code. The issue occurs when the system processes specific Bluetooth Low Energy (LE) synchronization requests, where an internal memory buffer is too small to hold the incoming data. This could lead to system instability or a complete service outage for devices relying on the affected Linux systems.
Technical details
A stack-based buffer overflow exists in the hci_le_big_create_sync() function within the Bluetooth HCI synchronization logic (net/bluetooth/hci_sync.c). The function uses DEFINE_FLEX to allocate a structure on the stack with space for only 17 Broadcast Isochronous Stream (BIS) entries, despite the kernel allowing up to 31 entries. When a connection contains more than 17 entries, a memcpy operation writes past the allocated stack buffer, leading to memory corruption. This can be triggered by a local user binding an ISO socket with a high number of BIS entries and calling listen(). Patches have been released for various stable kernel branches to increase the buffer size to the maximum supported limit.
Affected products
- Linux Linux Kernel 6.11.11 to 6.12, 6.12.2 to 6.12.81, 6.13.1 to 6.18.22, 6.19 to 6.19.12, 7.0-rc1 to 7.0-rc6
Timeline
- 2026-03-31: other: Vulnerability fix authored
- 2026-05-01: disclosed
- 2026-05-01: advisory