Executive brief
A security vulnerability has been identified in the Linux kernel's Bluetooth subsystem. A local user with administrative privileges could trigger a memory error that might lead to a system crash or potentially allow unauthorized access to sensitive system memory. This occurs when the system processes specific Bluetooth advertising data on Low Energy (LE) controllers.
Technical details
A stack-based out-of-bounds (OOB) write vulnerability exists in the eir_create_adv_data() function within net/bluetooth/eir.c. The issue arises because the kernel may prepend a 3-byte 'Flags' AD structure to a fixed-size buffer (31 bytes for legacy advertising) without verifying that the user-supplied advertising data still fits. If a user provides data that fills the buffer and the kernel subsequently adds the mandatory flags, a memcpy() operation overflows the stack buffer. This is reachable by a local user with CAP_NET_ADMIN privileges on a system with an LE-only controller using the legacy advertising path. The vulnerability has been patched by adding a bounds check to ensure flags are only prepended if space permits.
Affected products
- Linux Linux Kernel b44133ff03be to 0f0b6232af56441d0a2dcb173cc4f8d8aab39014
Timeline
- 2026-06-03: other: Patch authored
- 2026-07-24: patched: Patch committed to stable tree
- 2026-07-27: disclosed: CVE published
References
- https://git.kernel.org/stable/c/09301f1fdf2aef8cce34d0c4650c30e7edb1ced9
- https://git.kernel.org/stable/c/0f0b6232af56441d0a2dcb173cc4f8d8aab39014
- https://git.kernel.org/stable/c/57077eeb586c42f124bc09e018449362223067b3
- https://git.kernel.org/stable/c/6f5fb689fdf80bdd143f22a502f9eb1f3c85e286
- https://git.kernel.org/stable/c/f1b4df9c260c51726da2e86e19322825fddeefd0