CVE-2026-64403

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the Bluetooth L2CAP implementation where the l2cap get conf opt() function reads the opt->len field, which is controlled by an attacker, and dereferences opt->val before verifying that the required bytes are present in the buffer. This results in a validate-after-use ordering bug where up to 4 bytes are read out-of-bounds. The functions l2cap parse conf req(), l2cap parse conf rsp(), and l2cap conf rfc get() only detect the malformed option after the out-of-bounds read has occurred. While a subsequent length check prevents the leaked data from being consumed, the flaw remains a risk for future code changes.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.