CVE-2026-64539

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A stack-out-of-bounds write exists in the Bluetooth component. The eir create adv data() function constructs advertising data within a fixed-size buffer. When using the legacy path, the function may prepend a 3-byte Flags AD structure and subsequently copy per-instance data using memcpy() without verifying if the total size exceeds the buffer capacity. This occurs because tlv data max len() only reserves space for these bytes when user-supplied flags contain a managed-flags bit; if flags are set to 0, data is accepted up to the full buffer size, leading to an overflow when the kernel prepends the flags during advertising. This issue is reachable by a local user with CAP NET ADMIN privileges who owns an LE-only controller on the legacy advertising path.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.