Description
In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: eir: Fix stack OOB write when prepending the Flags AD

eir_create_adv_data() builds the advertising data into a fixed-size
buffer ("size", 31 for the legacy path). It may prepend a 3-byte "Flags"
AD structure (LE_AD_NO_BREDR on an LE-only controller) and then copies
the per-instance data without checking that it still fits:

memcpy(ptr, adv->adv_data, adv->adv_data_len);

tlv_data_max_len() only reserves those 3 bytes when the user-supplied
flags carry a managed-flags bit, so an instance added with flags == 0 is
accepted with adv_data_len up to the full buffer. At advertise time the
flags are still prepended, and the memcpy() writes 3 + adv_data_len
bytes into the size-byte buffer:

BUG: KASAN: stack-out-of-bounds in eir_create_adv_data (net/bluetooth/eir.c:301)
Write of size 31 at addr ffff88800a547bdc by task kworker/u9:0/65
Workqueue: hci0 hci_cmd_sync_work
__asan_memcpy (mm/kasan/shadow.c:106)
eir_create_adv_data (net/bluetooth/eir.c:301)
hci_update_adv_data_sync (net/bluetooth/hci_sync.c:1310)
hci_schedule_adv_instance_sync (net/bluetooth/hci_sync.c:1817)
hci_cmd_sync_work (net/bluetooth/hci_sync.c:332)
This frame has 1 object:
[32, 64) 'cp'

The "Flags" structure is added by the kernel, not requested by
userspace, so only prepend it when it fits together with the instance
advertising data; when there is no room for both, drop the flags rather
than the user-provided data.

Reachable by a local user with CAP_NET_ADMIN owning an LE-only
controller on the legacy advertising path.
Published: 2026-07-27
Score: 7.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A stack out‑of‑bounds write occurs in the kernel’s eir_create_adv_data routine when a 3‑byte Flags AD structure is prepended to advertising data that already occupies the full 31‑byte buffer. The copy operation does not check that the combined length fits, causing a 3‑byte overflow that corrupts stack memory. A local user who can configure Bluetooth LE advertising and has CAP_NET_ADMIN can trigger this condition, potentially leading to arbitrary code execution with kernel privileges. The vulnerability manifests only during the preparation of advertising data and does not involve any remote trigger.

Affected Systems

All Linux kernels that have not yet incorporated the commit adding bounds checking on the Flags AD are affected. This includes any distribution that ships the upstream kernel and exposes the legacy advertising path for Bluetooth LE controllers. The issue is triggered only if the system enables Bluetooth LE advertising and a process with CAP_NET_ADMIN configures advertising data.

Risk and Exploitability

The vulnerability is a local memory corruption bug with potential for kernel privilege escalation. The EPSS score is < 1% (indicating a low probability of exploitation), and the entry is not listed in CISA KEV. Because the flaw requires local administrative privileges (CAP_NET_ADMIN) and is limited to the Bluetooth legacy advertising path, exploitation is feasible only in environments where that capability is present. Given the severity of kernel stack corruption, the risk level is high and immediate remediation is recommended.

Generated by OpenCVE AI on August 3, 2026 at 16:45 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the Linux kernel to a version that includes the commit adding bounds checking for the Flags AD (e.g., incorporate the changes from the referenced commits).
  • If a kernel upgrade is not immediately possible, disable the legacy Bluetooth LE advertising path so that the vulnerable code path is not exercised.
  • Restrict CAP_NET_ADMIN privileges for users and services that configure Bluetooth to prevent the overflow condition from being triggered.

Generated by OpenCVE AI on August 3, 2026 at 16:45 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4720-1 linux security update
Debian DLA Debian DLA DLA-4723-1 linux-6.1 security update
Debian DLA Debian DLA DLA-4724-1 linux-6.12 new package
Debian DSA Debian DSA DSA-6405-1 linux security update
History

Sun, 02 Aug 2026 11:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-120
CWE-122

Thu, 30 Jul 2026 06:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

 cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Thu, 30 Jul 2026 01:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-120
CWE-122

Wed, 29 Jul 2026 12:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

threat_severity

Moderate

Mon, 27 Jul 2026 20:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: Bluetooth: eir: Fix stack OOB write when prepending the Flags AD eir_create_adv_data() builds the advertising data into a fixed-size buffer ("size", 31 for the legacy path). It may prepend a 3-byte "Flags" AD structure (LE_AD_NO_BREDR on an LE-only controller) and then copies the per-instance data without checking that it still fits: memcpy(ptr, adv->adv_data, adv->adv_data_len); tlv_data_max_len() only reserves those 3 bytes when the user-supplied flags carry a managed-flags bit, so an instance added with flags == 0 is accepted with adv_data_len up to the full buffer. At advertise time the flags are still prepended, and the memcpy() writes 3 + adv_data_len bytes into the size-byte buffer: BUG: KASAN: stack-out-of-bounds in eir_create_adv_data (net/bluetooth/eir.c:301) Write of size 31 at addr ffff88800a547bdc by task kworker/u9:0/65 Workqueue: hci0 hci_cmd_sync_work __asan_memcpy (mm/kasan/shadow.c:106) eir_create_adv_data (net/bluetooth/eir.c:301) hci_update_adv_data_sync (net/bluetooth/hci_sync.c:1310) hci_schedule_adv_instance_sync (net/bluetooth/hci_sync.c:1817) hci_cmd_sync_work (net/bluetooth/hci_sync.c:332) This frame has 1 object: [32, 64) 'cp' The "Flags" structure is added by the kernel, not requested by userspace, so only prepend it when it fits together with the instance advertising data; when there is no room for both, drop the flags rather than the user-provided data. Reachable by a local user with CAP_NET_ADMIN owning an LE-only controller on the legacy advertising path.
Title Bluetooth: eir: Fix stack OOB write when prepending the Flags AD
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-08-05T12:42:47.417Z

Reserved: 2026-07-19T15:36:31.795Z

Link: CVE-2026-64539

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-07-27T21:17:06.277

Modified: 2026-07-30T06:25:57.697

Link: CVE-2026-64539

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-07-27T00:00:00Z

Links: CVE-2026-64539 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-03T17:00:06Z

Weaknesses

No weakness.