CVE-2026-64126

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the Bluetooth MGMT component where the MGMT OP ADD EXT ADV DATA command fails to verify if the specified advertising data lengths are within the actual command payload. Specifically, the handler uses cp->adv data len and cp->scan rsp len to validate and copy cp->data without ensuring these bytes are part of the payload. This can lead to an out-of-bounds pointer being passed to the tlv data is valid() function. If the memory beyond the command buffer is addressable, it may be copied into the advertising instance as scan response data, allowing a user with CAP NET ADMIN privileges in the initial user namespace to read this data via MGMT OP GET ADV INSTANCE. This results in a slab-out-of-bounds read.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.