Executive brief
A vulnerability was identified in the Linux kernel's Bluetooth implementation. It affects the L2CAP protocol, which is used to manage data between Bluetooth devices. An attacker could potentially trigger an improper memory read by sending specially crafted Bluetooth configuration requests. While current analysis suggests this does not lead to a direct data leak, it represents a security flaw that could be exploited if other parts of the system change.
Technical details
An out-of-bounds read exists in net/bluetooth/l2cap_core.c within the l2cap_get_conf_opt() function. The function derives an option length from an attacker-controlled field (opt->len) and dereferences the value before verifying that the buffer actually contains the specified number of bytes. This results in a validate-after-use bug where up to 4 bytes can be read past the buffer end. While existing post-hoc checks currently prevent the consumption of this garbage data, the flaw represents a fragile memory safety violation. The fix introduces an explicit buffer-end check before the value is accessed.
Affected products
- Linux Linux Kernel 7c9cbd0b5e38a1672fcd137894ace3b042dfbf69 to cca81b4bc672604a84f6d224a55cc77ec7dee619
Timeline
- 2026-07-25: disclosed
- 2026-07-25: advisory
References
- https://git.kernel.org/stable/c/687617555cedfb74c9e3cb85d759b908dcb17856
- https://git.kernel.org/stable/c/6b47bdaacfd0045687880177e0987055d8f4765a
- https://git.kernel.org/stable/c/73abbaf91aa33da87c008fb62c148ade561bb606
- https://git.kernel.org/stable/c/7d871e969b941ce25653f7716203a0ea4d07ad4b
- https://git.kernel.org/stable/c/98d93c226bdfaa79bbdd86981921d7f106374225
- https://git.kernel.org/stable/c/996d3da39899aceb8f4910911a3f19a45a7d9d1b
- https://git.kernel.org/stable/c/cca81b4bc672604a84f6d224a55cc77ec7dee619