Executive brief
A vulnerability in the Linux kernel's Bluetooth subsystem could allow a nearby attacker to cause a system crash. The issue occurs when the system processes specially crafted Bluetooth advertising data, leading to an out-of-bounds memory read. This primarily impacts system stability and availability.
Technical details
An out-of-bounds read exists in the tlv_data_is_valid() function within net/bluetooth/mgmt.c. The parser reads the length of an advertising data field and immediately inspects the subsequent type byte (data[i + 1]) before verifying if that byte actually resides within the allocated buffer. A malformed MGMT_OP_ADD_ADVERTISING request with a length byte at the very end of the buffer triggers a KASAN vmalloc-out-of-bounds error. The fix reorders the validation logic to ensure the element length is checked against the total buffer size before any type-octet inspection occurs.
Affected products
- Linux Linux 2bb36870e8cb to 13ad995071a0, 06fcbd79c3c3, f7093ac233c1, 74c08e4db35a, 18fea1cb0c25, 1a3c8ffbb46, 2a3f3ed9e198, de23fb62259aa
Timeline
- 2026-06-25: disclosed
- 2026-06-25: advisory
References
- https://git.kernel.org/stable/c/06fcbd79c3c360a50f9be9d370769bbd738d0976
- https://git.kernel.org/stable/c/13ad995071a06570668dd8daab3616c247c72080
- https://git.kernel.org/stable/c/18fea1cb0c2599752e908c8217490f73ddd33e00
- https://git.kernel.org/stable/c/1a3c8ffbb469859b076445af44bdfa6a711d483e
- https://git.kernel.org/stable/c/2a3f3ed9e198ae23c15859ace2f9ca6cfdc35b57
- https://git.kernel.org/stable/c/74c08e4db35a476c3462aeb65846f955be732626
- https://git.kernel.org/stable/c/de23fb62259aa01d294f77238ae3b835eb674413