Executive brief
A vulnerability was identified in the Linux kernel's Bluetooth driver for NXP chipsets. An attacker with access to the Bluetooth controller could request data beyond the intended firmware boundaries, potentially leading to the exposure of sensitive system memory. This could compromise the confidentiality of data stored on the affected device.
Technical details
An out-of-bounds read vulnerability exists in the 'nxp_recv_fw_req_v3()' function within 'drivers/bluetooth/btnxpuart.c'. During the v3 firmware download sequence, the driver processes a 'v3_data_req' from the controller containing a 32-bit offset and a 16-bit length. The driver failed to validate that the requested offset plus length remained within the bounds of the loaded firmware image buffer ('nxpdev->fw->size'). Consequently, a crafted request allows an attacker to read arbitrary kernel memory adjacent to the firmware buffer and transmit it over the UART. The fix introduces boundary checks to reject requests falling outside the firmware image.
Affected products
- Linux Linux Kernel 6.4 to 7.1.4
Timeline
- 2026-06-17: disclosed: Initial patch authored
- 2026-07-24: patched: Patch committed to stable tree
- 2026-07-25: advisory: CVE published
References
- https://git.kernel.org/stable/c/21e60eb4d95854196e7c0e77383f35e7ac95df61
- https://git.kernel.org/stable/c/2a68a773089204af1c8581dc79668b775418c5ee
- https://git.kernel.org/stable/c/441088792ffec3ca01f4efe2934060570eb11eb8
- https://git.kernel.org/stable/c/49bcb39e3a041ce26021f77971eaccb49a275118
- https://git.kernel.org/stable/c/badff6c3bed8923a1257a853f137d447976eec30