CVE-2026-64539 (GCVE-0-2026-64539)

Vulnerability from cvelistv5 – Published: 2026-07-27 20:10 – Updated: 2026-08-05 12:42
VLAI
Title
Bluetooth: eir: Fix stack OOB write when prepending the Flags AD
Summary
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: eir: Fix stack OOB write when prepending the Flags AD eir_create_adv_data() builds the advertising data into a fixed-size buffer ("size", 31 for the legacy path). It may prepend a 3-byte "Flags" AD structure (LE_AD_NO_BREDR on an LE-only controller) and then copies the per-instance data without checking that it still fits: memcpy(ptr, adv->adv_data, adv->adv_data_len); tlv_data_max_len() only reserves those 3 bytes when the user-supplied flags carry a managed-flags bit, so an instance added with flags == 0 is accepted with adv_data_len up to the full buffer. At advertise time the flags are still prepended, and the memcpy() writes 3 + adv_data_len bytes into the size-byte buffer: BUG: KASAN: stack-out-of-bounds in eir_create_adv_data (net/bluetooth/eir.c:301) Write of size 31 at addr ffff88800a547bdc by task kworker/u9:0/65 Workqueue: hci0 hci_cmd_sync_work __asan_memcpy (mm/kasan/shadow.c:106) eir_create_adv_data (net/bluetooth/eir.c:301) hci_update_adv_data_sync (net/bluetooth/hci_sync.c:1310) hci_schedule_adv_instance_sync (net/bluetooth/hci_sync.c:1817) hci_cmd_sync_work (net/bluetooth/hci_sync.c:332) This frame has 1 object: [32, 64) 'cp' The "Flags" structure is added by the kernel, not requested by userspace, so only prepend it when it fits together with the instance advertising data; when there is no room for both, drop the flags rather than the user-provided data. Reachable by a local user with CAP_NET_ADMIN owning an LE-only controller on the legacy advertising path.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: b44133ff03be30b55f23036e62f403a3f7784fce , < 0f0b6232af56441d0a2dcb173cc4f8d8aab39014 (git)
Affected: b44133ff03be30b55f23036e62f403a3f7784fce , < 09301f1fdf2aef8cce34d0c4650c30e7edb1ced9 (git)
Affected: b44133ff03be30b55f23036e62f403a3f7784fce , < f1b4df9c260c51726da2e86e19322825fddeefd0 (git)
Affected: b44133ff03be30b55f23036e62f403a3f7784fce , < 57077eeb586c42f124bc09e018449362223067b3 (git)
Affected: b44133ff03be30b55f23036e62f403a3f7784fce , < 6f5fb689fdf80bdd143f22a502f9eb1f3c85e286 (git)
Create a notification for this product.
Linux Linux Affected: 4.1
Unaffected: 0 , < 4.1 (semver)
Unaffected: 6.1.178 , ≤ 6.1.* (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/eir.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0f0b6232af56441d0a2dcb173cc4f8d8aab39014",
              "status": "affected",
              "version": "b44133ff03be30b55f23036e62f403a3f7784fce",
              "versionType": "git"
            },
            {
              "lessThan": "09301f1fdf2aef8cce34d0c4650c30e7edb1ced9",
              "status": "affected",
              "version": "b44133ff03be30b55f23036e62f403a3f7784fce",
              "versionType": "git"
            },
            {
              "lessThan": "f1b4df9c260c51726da2e86e19322825fddeefd0",
              "status": "affected",
              "version": "b44133ff03be30b55f23036e62f403a3f7784fce",
              "versionType": "git"
            },
            {
              "lessThan": "57077eeb586c42f124bc09e018449362223067b3",
              "status": "affected",
              "version": "b44133ff03be30b55f23036e62f403a3f7784fce",
              "versionType": "git"
            },
            {
              "lessThan": "6f5fb689fdf80bdd143f22a502f9eb1f3c85e286",
              "status": "affected",
              "version": "b44133ff03be30b55f23036e62f403a3f7784fce",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/eir.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.1"
            },
            {
              "lessThan": "4.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "4.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "4.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "4.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "4.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2-rc1",
                  "versionStartIncluding": "4.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: eir: Fix stack OOB write when prepending the Flags AD\n\neir_create_adv_data() builds the advertising data into a fixed-size\nbuffer (\"size\", 31 for the legacy path). It may prepend a 3-byte \"Flags\"\nAD structure (LE_AD_NO_BREDR on an LE-only controller) and then copies\nthe per-instance data without checking that it still fits:\n\n\tmemcpy(ptr, adv-\u003eadv_data, adv-\u003eadv_data_len);\n\ntlv_data_max_len() only reserves those 3 bytes when the user-supplied\nflags carry a managed-flags bit, so an instance added with flags == 0 is\naccepted with adv_data_len up to the full buffer. At advertise time the\nflags are still prepended, and the memcpy() writes 3 + adv_data_len\nbytes into the size-byte buffer:\n\n  BUG: KASAN: stack-out-of-bounds in eir_create_adv_data (net/bluetooth/eir.c:301)\n  Write of size 31 at addr ffff88800a547bdc by task kworker/u9:0/65\n  Workqueue: hci0 hci_cmd_sync_work\n   __asan_memcpy (mm/kasan/shadow.c:106)\n   eir_create_adv_data (net/bluetooth/eir.c:301)\n   hci_update_adv_data_sync (net/bluetooth/hci_sync.c:1310)\n   hci_schedule_adv_instance_sync (net/bluetooth/hci_sync.c:1817)\n   hci_cmd_sync_work (net/bluetooth/hci_sync.c:332)\n  This frame has 1 object:\n   [32, 64) \u0027cp\u0027\n\nThe \"Flags\" structure is added by the kernel, not requested by\nuserspace, so only prepend it when it fits together with the instance\nadvertising data; when there is no room for both, drop the flags rather\nthan the user-provided data.\n\nReachable by a local user with CAP_NET_ADMIN owning an LE-only\ncontroller on the legacy advertising path."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The overflow is driven entirely by locally supplied advertising data written to an AF_BLUETOOTH HCI control socket (MGMT_OP_ADD_ADVERTISING / ADD_EXT_ADV_DATA / MESH_SEND); no remote or adjacent Bluetooth peer can influence the length or contents. Consistent with the same-class CVE-2026-53209 and CVE-2026-64126, this is a local-only trigger.\nAC:L - The attacker fully controls both preconditions \u2014 submit an instance with flags==0 and adv_data_len at the maximum, containing no EIR_FLAGS element \u2014 and the kernel then deterministically prepends the 3-byte Flags AD on any LE-only controller. No race, no memory-layout luck, no retry needed.\nPR:L - Reaching the mgmt handler requires HCI_SOCK_TRUSTED, granted by CAP_NET_ADMIN, which is a delegated capability routinely held by the Bluetooth stack daemon rather than full system root, and this CNA scores the identical CAP_NET_ADMIN-gated Bluetooth mgmt paths (CVE-2026-64126, CVE-2026-53209, CVE-2026-31511) as PR:L. Choosing the higher-severity option where the privilege boundary is arguable.\nUI:N - The attacker issues the mgmt commands itself and the overflow fires from hci_cmd_sync_work when the instance is scheduled for advertising. No victim action of any kind is involved.\nS:U - The corruption is confined to the kernel\u0027s own stack within the same security authority; there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - On the extended-advertising path the inflated length (254 \u003e 251) makes struct_size() copy 3 bytes of adjacent kernel stack past the DEFINE_FLEX pdu into the HCI command skb, which is exposed via the HCI monitor channel and handed to the controller for broadcast, and the stack corruption is generally leverageable for further disclosure.\nI:H - This is an out-of-bounds write of fully attacker-controlled bytes (the tail of the user-supplied adv_data) past a local stack object, and it additionally leaves hdev-\u003eadv_data_len set to a value larger than the data actually stored. An attacker-controlled linear stack overflow is treated as high integrity impact.\nA:H - Overwriting bytes immediately past the stack object corrupts adjacent frame state and, with CONFIG_STACKPROTECTOR, will trip __stack_chk_fail leading to a kernel panic; the reported KASAN stack-out-of-bounds confirms real memory corruption in hci_cmd_sync_work."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:42:47.417Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0f0b6232af56441d0a2dcb173cc4f8d8aab39014"
        },
        {
          "url": "https://git.kernel.org/stable/c/09301f1fdf2aef8cce34d0c4650c30e7edb1ced9"
        },
        {
          "url": "https://git.kernel.org/stable/c/f1b4df9c260c51726da2e86e19322825fddeefd0"
        },
        {
          "url": "https://git.kernel.org/stable/c/57077eeb586c42f124bc09e018449362223067b3"
        },
        {
          "url": "https://git.kernel.org/stable/c/6f5fb689fdf80bdd143f22a502f9eb1f3c85e286"
        }
      ],
      "title": "Bluetooth: eir: Fix stack OOB write when prepending the Flags AD",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64539",
    "datePublished": "2026-07-27T20:10:33.363Z",
    "dateReserved": "2026-07-19T15:36:31.795Z",
    "dateUpdated": "2026-08-05T12:42:47.417Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-64539",
      "date": "2026-08-06",
      "epss": "0.00122",
      "percentile": "0.02345"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-64539\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-07-27T21:17:06.277\",\"lastModified\":\"2026-07-30T06:25:57.697\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nBluetooth: eir: Fix stack OOB write when prepending the Flags AD\\n\\neir_create_adv_data() builds the advertising data into a fixed-size\\nbuffer (\\\"size\\\", 31 for the legacy path). It may prepend a 3-byte \\\"Flags\\\"\\nAD structure (LE_AD_NO_BREDR on an LE-only controller) and then copies\\nthe per-instance data without checking that it still fits:\\n\\n\\tmemcpy(ptr, adv-\u003eadv_data, adv-\u003eadv_data_len);\\n\\ntlv_data_max_len() only reserves those 3 bytes when the user-supplied\\nflags carry a managed-flags bit, so an instance added with flags == 0 is\\naccepted with adv_data_len up to the full buffer. At advertise time the\\nflags are still prepended, and the memcpy() writes 3 + adv_data_len\\nbytes into the size-byte buffer:\\n\\n  BUG: KASAN: stack-out-of-bounds in eir_create_adv_data (net/bluetooth/eir.c:301)\\n  Write of size 31 at addr ffff88800a547bdc by task kworker/u9:0/65\\n  Workqueue: hci0 hci_cmd_sync_work\\n   __asan_memcpy (mm/kasan/shadow.c:106)\\n   eir_create_adv_data (net/bluetooth/eir.c:301)\\n   hci_update_adv_data_sync (net/bluetooth/hci_sync.c:1310)\\n   hci_schedule_adv_instance_sync (net/bluetooth/hci_sync.c:1817)\\n   hci_cmd_sync_work (net/bluetooth/hci_sync.c:332)\\n  This frame has 1 object:\\n   [32, 64) \u0027cp\u0027\\n\\nThe \\\"Flags\\\" structure is added by the kernel, not requested by\\nuserspace, so only prepend it when it fits together with the instance\\nadvertising data; when there is no room for both, drop the flags rather\\nthan the user-provided data.\\n\\nReachable by a local user with CAP_NET_ADMIN owning an LE-only\\ncontroller on the legacy advertising path.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/bluetooth/eir.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"b44133ff03be30b55f23036e62f403a3f7784fce\",\"lessThan\":\"0f0b6232af56441d0a2dcb173cc4f8d8aab39014\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b44133ff03be30b55f23036e62f403a3f7784fce\",\"lessThan\":\"09301f1fdf2aef8cce34d0c4650c30e7edb1ced9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b44133ff03be30b55f23036e62f403a3f7784fce\",\"lessThan\":\"f1b4df9c260c51726da2e86e19322825fddeefd0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b44133ff03be30b55f23036e62f403a3f7784fce\",\"lessThan\":\"57077eeb586c42f124bc09e018449362223067b3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b44133ff03be30b55f23036e62f403a3f7784fce\",\"lessThan\":\"6f5fb689fdf80bdd143f22a502f9eb1f3c85e286\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/bluetooth/eir.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.1\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.1\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.178\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.97\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.40\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.5\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/09301f1fdf2aef8cce34d0c4650c30e7edb1ced9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/0f0b6232af56441d0a2dcb173cc4f8d8aab39014\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/57077eeb586c42f124bc09e018449362223067b3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6f5fb689fdf80bdd143f22a502f9eb1f3c85e286\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f1b4df9c260c51726da2e86e19322825fddeefd0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-05T12:16:58+00:00",
      "cve": "CVE-2026-64539",
      "id": "CVE-2026-64539",
      "initial_release_date": "2026-07-27T00:00:00+00:00",
      "product_status:known_affected": "232",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Bluetooth: eir: Fix stack OOB write when prepending the Flags AD",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64539.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-03T17:13:21Z",
      "cve": "CVE-2026-64539",
      "id": "CVE-2026-64539",
      "initial_release_date": "2026-07-28T17:08:08Z",
      "product_status:known_affected": "193",
      "product_status:known_not_affected": "105",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-64539",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-64539.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.