CVE-2026-64549

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An out-of-bounds read exists in the Bluetooth bpa10x component. The bpa10x setup() function sends a vendor command 0xfc0e and processes the response using bt dev info() and hci set fw info() as a string starting at skb->data + 1 without verifying the length. If a device returns a one-byte response or a payload that is not NUL-terminated within skb->len, the system reads adjacent slab memory until a NUL character is encountered. This results in out-of-bounds bytes being written to the kernel log and the firmware-info debugfs file.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.