Executive brief
A vulnerability was identified in the Linux kernel's Bluetooth subsystem that could lead to a system crash or memory corruption. When the system processes certain Bluetooth broadcast announcements, it may attempt to combine data in a way that exceeds the size of its internal storage buffer. This could allow a nearby attacker to disrupt the device's operations or potentially gain unauthorized access to system memory.
Technical details
A buffer overflow vulnerability exists in the Linux kernel Bluetooth stack within the `hci_adv_bcast_annoucement` function in `net/bluetooth/hci_sync.c`. The issue occurs when the function prepends Broadcast Announcement service data to an existing advertising payload that is already at or near the maximum extended advertising payload size. This combined data can exceed the fixed-size temporary buffer used to rebuild the advertising data, leading to a memory overrun during the `memcpy` operation. An attacker within Bluetooth range could potentially exploit this to cause a denial of service (kernel panic) or achieve arbitrary code execution. The fix introduces a bounds check to reject payloads that would exceed the buffer capacity before the copy occurs.
Affected products
- Linux Linux Kernel 6.1.142 to 6.1.176, 6.6.94 to 6.6.143, 6.12.34 to 6.12.94, 6.15.3 to 6.16
Timeline
- 2026-06-25: disclosed
- 2026-06-25: advisory
References
- https://git.kernel.org/stable/c/02f50e8bb69f9b22516163a09922f5537d3b12d1
- https://git.kernel.org/stable/c/10b0e832cc05d7aef4b92bed912cbd4a395d0862
- https://git.kernel.org/stable/c/1338ee049a8910ba6c9cee963920e978e6893c7d
- https://git.kernel.org/stable/c/5c65b96b549ea2dcfde497436bf9e048deb87758
- https://git.kernel.org/stable/c/cdd8bbdbee763fdf5bf343e6f7d4e79347739f62
- https://git.kernel.org/stable/c/dafc9f57140e66a10945127aa7433c3d715dc253