CVE-2026-64126 - Vulnerability Details

- Bluetooth: MGMT: validate Add Extended Advertising Data length

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: MGMT: validate Add Extended Advertising Data length

MGMT_OP_ADD_EXT_ADV_DATA is registered as a variable-length command,
with MGMT_ADD_EXT_ADV_DATA_SIZE as the fixed header size. The handler
then uses cp->adv_data_len and cp->scan_rsp_len to validate and copy
cp->data, but it never checks that those bytes are part of the mgmt
command payload.

A short command can therefore make add_ext_adv_data() pass an
out-of-bounds pointer into tlv_data_is_valid(). If the bytes beyond
the command buffer are addressable, they can also be copied into the
advertising instance as scan response data, where the caller can read
them back via MGMT_OP_GET_ADV_INSTANCE. The trigger requires
CAP_NET_ADMIN in the initial user namespace; KASAN reports an 8-byte
slab-out-of-bounds read.

Reject commands whose length does not match the fixed header plus both
advertising data lengths before parsing cp->data.

Published: 2026-07-19

Score: 7.3 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel’s Bluetooth Management (MGMT) layer exposes a bug in the handling of the Add Extended Advertising Data command. The size of the command is not fully validated, allowing a specially crafted request to cause an out‑of‑bounds read of the mgmt command buffer. The fault occurs in tlv_data_is_valid, which results in a kernel read of memory that is not part of the command payload, as confirmed by the KASAN output. This read can be exfiltrated back to the attacker through the GET_ADV_INSTANCE operation, providing a channel for information disclosure. The flaw requires the sender to possess CAP_NET_ADMIN in the initial user namespace, so it is a local privileged threat but could be leveraged by an attacker who gains local administrative privileges.

Affected Systems

Affected systems are all Linux kernel distributions that have shipped the unpatched code. The kernel is identified as Linux:Linux, and the numbers are not listed in the data, but the commit series that introduced the patch is referenced in the advisory links.

Risk and Exploitability

Risk and exploitability assessment: The CVSS score of 7.3 indicates a moderate to high severity impact. The EPSS score of < 1% suggests, and the vulnerability is not currently listed in CISA’s KEV catalog. Nonetheless, because the bug can leak kernel memory and requires only local privilege escalation, organizations running Bluetooth services should prioritize applying the fix before a potential exploit is discovered.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`12410572833a283ce92fcf9679ca8a2f372097ee`	affected	< 0d5104390b445e7bd664ad583837e4c04d892c9d
`12410572833a283ce92fcf9679ca8a2f372097ee`	affected	< 14b01b9cba04e6ce82825f68fc4c4322fa4ffa43
`12410572833a283ce92fcf9679ca8a2f372097ee`	affected	< a143ce77a5292f2c9285137433d879ce71d190a7
`12410572833a283ce92fcf9679ca8a2f372097ee`	affected	< a6c75a3fad226ccbd8ef9110dee87c92c299f2ab
`12410572833a283ce92fcf9679ca8a2f372097ee`	affected	< f1febe93ef075314615f970a87681d9ab86691d1
`12410572833a283ce92fcf9679ca8a2f372097ee`	affected	< 0bc1a5a69f541859293d79db72bd7854ac48df51
`12410572833a283ce92fcf9679ca8a2f372097ee`	affected	< d3f7d17960ed50df3a6709c5158caff989c8c905

Linux

affected

Version	Status	Constraints
`5.11`	affected	—
`0`	unaffected	< 5.11
`5.15.210`	unaffected	≤ 5.15.*
`6.1.175`	unaffected	≤ 6.1.*
`6.6.142`	unaffected	≤ 6.6.*
`6.12.92`	unaffected	≤ 6.12.*
`6.18.34`	unaffected	≤ 6.18.*
`7.0.11`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[12410572833a283ce92fcf9679ca8a2f372097ee,0d5104390b445e7bd664ad583837e4c04d892c9d)`	affected	code_commit	—
`[12410572833a283ce92fcf9679ca8a2f372097ee,14b01b9cba04e6ce82825f68fc4c4322fa4ffa43)`	affected	code_commit	—
`[12410572833a283ce92fcf9679ca8a2f372097ee,a143ce77a5292f2c9285137433d879ce71d190a7)`	affected	code_commit	—
`[12410572833a283ce92fcf9679ca8a2f372097ee,a6c75a3fad226ccbd8ef9100dee87c92c299f2ab)`	affected	code_commit	—
`[12410572833a283ce92fcf9679ca8a2f372097ee,f1febe93ef075314615f970a87681d9ab86691d1)`	affected	code_commit	—
`[12410572833a283ce92fcf9679ca8a2f372097ee,0bc1a5a69f541859293d79db72bd7854ac48df51)`	affected	code_commit	—
`[12410572833a283ce92fcf9679ca8a2f372097ee,d3f7d17960ed50df3a6709c5158caff989c8c905)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.11`	affected	generic	—
`[0,5.11)`	unaffected	generic	—
`[5.15.210,5.15.*]`	unaffected	generic	—
`[6.1.175,6.1.*]`	unaffected	generic	—
`[6.6.142,6.6.*]`	unaffected	generic	—
`[6.12.92,6.12.*]`	unaffected	generic	—
`[6.18.34,6.18.*]`	unaffected	generic	—
`[7.0.11,7.0.*]`	unaffected	generic	—
`[7.1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the Linux kernel to the latest patched release that includes the commit fixing this issue
If updating the kernel immediately is not possible, disable the Bluetooth MGMT interface or block the Add Extended Advertising Data command via firewall or administration policies
After applying the patch or workaround, monitor kernel logs for any anomalous access patterns or memory corruption events, and verify that the operation no longer causes out‑of‑bounds reads

Generated by OpenCVE AI on July 30, 2026 at 20:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Ubuntu USN	USN-8593-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8603-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8618-1	Linux kernel vulnerabilities

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00135.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/0bc1a5a69f541859293d79db72bd7854ac48df51
https://git.kernel.org/stable/c/0d5104390b445e7bd664ad583837e4c04d892c9d
https://git.kernel.org/stable/c/14b01b9cba04e6ce82825f68fc4c4322fa4ffa43
https://git.kernel.org/stable/c/a143ce77a5292f2c9285137433d879ce71d190a7
https://git.kernel.org/stable/c/a6c75a3fad226ccbd8ef9110dee87c92c299f2ab
https://git.kernel.org/stable/c/d3f7d17960ed50df3a6709c5158caff989c8c905
https://git.kernel.org/stable/c/f1febe93ef075314615f970a87681d9ab86691d1
https://lore.kernel.org/linux-cve-announce/2026071925-CVE-2026-64126-a17e@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-64126
https://www.cve.org/CVERecord?id=CVE-2026-64126

History

Tue, 21 Jul 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-805
References		https://lore.kernel.org/linux-cve-announce/2026071925-CVE-2026-64126-a17e@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-64126 https://www.cve.org/CVERecord?id=CVE-2026-64126
Metrics	threat_severity `None`	threat_severity `Moderate`

Mon, 20 Jul 2026 14:45:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L'}`

Sun, 19 Jul 2026 16:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: validate Add Extended Advertising Data length MGMT_OP_ADD_EXT_ADV_DATA is registered as a variable-length command, with MGMT_ADD_EXT_ADV_DATA_SIZE as the fixed header size. The handler then uses cp->adv_data_len and cp->scan_rsp_len to validate and copy cp->data, but it never checks that those bytes are part of the mgmt command payload. A short command can therefore make add_ext_adv_data() pass an out-of-bounds pointer into tlv_data_is_valid(). If the bytes beyond the command buffer are addressable, they can also be copied into the advertising instance as scan response data, where the caller can read them back via MGMT_OP_GET_ADV_INSTANCE. The trigger requires CAP_NET_ADMIN in the initial user namespace; KASAN reports an 8-byte slab-out-of-bounds read. Reject commands whose length does not match the fixed header plus both advertising data lengths before parsing cp->data.
Title		Bluetooth: MGMT: validate Add Extended Advertising Data length
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0bc1a5a69f541859293d79db72bd7854ac48df51 https://git.kernel.org/stable/c/0d5104390b445e7bd664ad583837e4c04d892c9d https://git.kernel.org/stable/c/14b01b9cba04e6ce82825f68fc4c4322fa4ffa43 https://git.kernel.org/stable/c/a143ce77a5292f2c9285137433d879ce71d190a7 https://git.kernel.org/stable/c/a6c75a3fad226ccbd8ef9110dee87c92c299f2ab https://git.kernel.org/stable/c/d3f7d17960ed50df3a6709c5158caff989c8c905 https://git.kernel.org/stable/c/f1febe93ef075314615f970a87681d9ab86691d1

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-19T15:40:23.276Z

Updated: 2026-08-05T12:39:32.975Z

Reserved: 2026-07-19T07:54:57.036Z

Link: CVE-2026-64126

Vulnrichment

No data.

NVD

No data.

Redhat

Severity : Moderate

Publid Date: 2026-07-19T00:00:00Z

Links: CVE-2026-64126 - Bugzilla

OpenCVE Enrichment

Updated: 2026-07-30T20:30:04Z

Weaknesses

CWE-805
Buffer Access with Incorrect Length Value

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact Low

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object