CVE-2026-64573

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An integer underflow exists in the TLV parser of the Bluetooth qca component. In the TLV TYPE NVM branch of the qca tlv check data() function, the loop bound calculation uses a signed integer length from the firmware TLV header. When length is less than 12, the subtraction of sizeof(struct tlv type nvm) causes the value to wrap to a very large size t. This leads to an out-of-bounds read of a 12-byte struct tlv type nvm beyond the end of the allocated firmware buffer, and potentially allows EDL TAG ID * handlers to write past the buffer boundary.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.