{"id":"CVE-2026-64126","summary":"Bluetooth: MGMT: validate Add Extended Advertising Data length","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: MGMT: validate Add Extended Advertising Data length\n\nMGMT_OP_ADD_EXT_ADV_DATA is registered as a variable-length command,\nwith MGMT_ADD_EXT_ADV_DATA_SIZE as the fixed header size.  The handler\nthen uses cp-\u003eadv_data_len and cp-\u003escan_rsp_len to validate and copy\ncp-\u003edata, but it never checks that those bytes are part of the mgmt\ncommand payload.\n\nA short command can therefore make add_ext_adv_data() pass an\nout-of-bounds pointer into tlv_data_is_valid().  If the bytes beyond\nthe command buffer are addressable, they can also be copied into the\nadvertising instance as scan response data, where the caller can read\nthem back via MGMT_OP_GET_ADV_INSTANCE.  The trigger requires\nCAP_NET_ADMIN in the initial user namespace; KASAN reports an 8-byte\nslab-out-of-bounds read.\n\nReject commands whose length does not match the fixed header plus both\nadvertising data lengths before parsing cp-\u003edata.","modified":"2026-07-22T05:30:01.672610358Z","published":"2026-07-19T15:40:23.276Z","database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64126.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/0bc1a5a69f541859293d79db72bd7854ac48df51"},{"type":"WEB","url":"https://git.kernel.org/stable/c/0d5104390b445e7bd664ad583837e4c04d892c9d"},{"type":"WEB","url":"https://git.kernel.org/stable/c/14b01b9cba04e6ce82825f68fc4c4322fa4ffa43"},{"type":"WEB","url":"https://git.kernel.org/stable/c/a143ce77a5292f2c9285137433d879ce71d190a7"},{"type":"WEB","url":"https://git.kernel.org/stable/c/a6c75a3fad226ccbd8ef9110dee87c92c299f2ab"},{"type":"WEB","url":"https://git.kernel.org/stable/c/d3f7d17960ed50df3a6709c5158caff989c8c905"},{"type":"WEB","url":"https://git.kernel.org/stable/c/f1febe93ef075314615f970a87681d9ab86691d1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64126.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64126"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"12410572833a283ce92fcf9679ca8a2f372097ee"},{"fixed":"0d5104390b445e7bd664ad583837e4c04d892c9d"},{"fixed":"14b01b9cba04e6ce82825f68fc4c4322fa4ffa43"},{"fixed":"a143ce77a5292f2c9285137433d879ce71d190a7"},{"fixed":"a6c75a3fad226ccbd8ef9110dee87c92c299f2ab"},{"fixed":"f1febe93ef075314615f970a87681d9ab86691d1"},{"fixed":"0bc1a5a69f541859293d79db72bd7854ac48df51"},{"fixed":"d3f7d17960ed50df3a6709c5158caff989c8c905"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64126.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.11.0"},{"fixed":"5.15.210"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"6.1.175"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.142"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.92"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.34"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.0.11"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64126.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L"}]}