Executive brief
The Linux kernel's Bluetooth subsystem contains a buffer-read vulnerability in the advertising data (EIR) parsing function. An attacker could exploit this through a specially crafted Bluetooth periodic advertisement with mismatched service data fields, causing the kernel to read memory beyond buffer boundaries. This could leak sensitive kernel memory or crash the system, affecting the availability and confidentiality of Bluetooth-enabled devices.
Technical details
The vulnerability is an out-of-bounds (OOB) read in the eir_get_service_data() function in net/bluetooth/eir.c. The function iterates through advertising data fields, advancing a pointer by dlen (the data length) on mismatch. However, dlen only includes the field payload, not the 2-byte length-and-type header, causing eir_len to become incorrect. This miscalculation compounds across multiple fields until the pointer and size tracking drift past the buffer boundary. For ISO broadcast sinks, this reads into adjacent kernel structures in hci_conn. The fix recomputes eir_len from the buffer end pointer on each iteration. The vulnerability requires network-reachable Bluetooth periodic advertisements but no authentication.
Affected products
- Linux Linux kernel 5.8 and later (prior to fix commit 4beb198bc59b)
Timeline
- 2026-09-11: disclosed: CVE-2026-89583 published
- 2026-08-24: patched: Upstream fix commit 4beb198bc59b merged
- 2026-09-14: patched: Stable kernel patch released