Executive brief
A vulnerability in the Linux kernel's Bluetooth management component could allow a local user with administrative privileges to read sensitive information from the system's memory. This occurs because the system does not properly verify the length of certain Bluetooth advertising data commands. An attacker could exploit this to bypass security boundaries and access data they are not authorized to see, potentially compromising system confidentiality.
Technical details
A slab-out-of-bounds read vulnerability exists in the Linux kernel's Bluetooth MGMT implementation within 'net/bluetooth/mgmt.c'. The 'MGMT_OP_ADD_EXT_ADV_DATA' command handler uses length fields ('adv_data_len' and 'scan_rsp_len') provided in the command header to copy data without verifying that the actual payload length matches these values. A local attacker with 'CAP_NET_ADMIN' privileges can submit a truncated command, causing the kernel to read up to 8 bytes beyond the allocated buffer. This out-of-bounds data can then be retrieved by the attacker via 'MGMT_OP_GET_ADV_INSTANCE', resulting in a kernel memory leak. The issue has been patched in multiple stable branches by adding explicit length validation before parsing the payload.
Affected products
- Linux Linux Kernel 5.11 to 6.9.x
Timeline
- 2026-05-15: other: Vulnerability fixed in upstream source code
- 2026-07-19: disclosed: CVE-2026-64126 published
References
- https://git.kernel.org/stable/c/0bc1a5a69f541859293d79db72bd7854ac48df51
- https://git.kernel.org/stable/c/0d5104390b445e7bd664ad583837e4c04d892c9d
- https://git.kernel.org/stable/c/14b01b9cba04e6ce82825f68fc4c4322fa4ffa43
- https://git.kernel.org/stable/c/a143ce77a5292f2c9285137433d879ce71d190a7
- https://git.kernel.org/stable/c/a6c75a3fad226ccbd8ef9110dee87c92c299f2ab
- https://git.kernel.org/stable/c/d3f7d17960ed50df3a6709c5158caff989c8c905
- https://git.kernel.org/stable/c/f1febe93ef075314615f970a87681d9ab86691d1