CVE-2026-53255

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the Bluetooth MGMT component where the tlv data is valid() function reads the advertising data field length from data[i] and inspects data[i + 1] for managed EIR (Enhanced Inquiry Response) types before verifying if the current field fits within the supplied buffer. A malformed field with a length byte positioned as the last byte of the buffer can cause the parser to read one byte beyond the advertising data, leading to a vmalloc-out-of-bounds read when processing a MGMT OP ADD ADVERTISING request.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.