Medium 5.5Published Apr 17, 2024

CVE-2024-26889Bluetooth: hci_core: Fix possible buffer overflow

Updated under an hour ago (Oct 27, 2026, 7:40 AM ET)

Does this affect you?

It affects Linux and 3 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: Fix possible buffer overflow struct hci_dev_info has a fixed size name[8] field so in the event that hdev->name is bigger than that strcpy would attempt to write past its size, so this fixes this problem by switching to use strscpy.

CVSS: 5.5 MEDIUM (v3.1, CISA ADP)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): CWE-120
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 14, 2026
First seen by InfoSec Signals: Oct 14, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	194ab82c1ea187512ff2f822124bd05b63fc9f76 builds before 6d5a9d4a7bcbb7534ce45a18a52e7bd23e69d8ac; from b48595f5b1c6e81e06e164e7d2b7a30b1776161e before 54a03e4ac1a41edf8a5087bd59f8241b0de96d3d; from ffb060b136dd75a033ced0fc0aed2882c02e8b56 before d47e6c1932cee02954ea588c9f09fd5ecefeadfc; from bbec1724519ecd9c468d1186a8f30b7567175bfb before 2e845867b4e279eff0a19ade253390470e07e8a1; from dcda165706b9fbfd685898d46a6749d7d397e0c0 before a41c8efe659caed0e21422876bbb6b73c15b5244; from dcda165706b9fbfd685898d46a6749d7d397e0c0 before 8c28598a2c29201d2ba7fc37539a7d41c264fb10; from dcda165706b9fbfd685898d46a6749d7d397e0c0 before 2edce8e9a99dd5e4404259d52e754fdc97fb42c2; from dcda165706b9fbfd685898d46a6749d7d397e0c0 before 81137162bfaa7278785b24c1fd2e9e74f082e8e4; and 10 more ranges	CNA record
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem siemens:simatic_s7_1500_tm_mfp_gnu_linux_subsystem (from the name)	before V1.1.1	CISA ADP
linux linux_kernel linux:linux_kernel	from 4.14.328 before 4.15; from 4.19.297 before 4.19.311; from 5.4.259 before 5.4.273; from 5.10.199 before 5.10.214; from 5.15.137 before 5.15.153; from 6.1.60 before 6.1.83; from 6.5.9 before 6.6.23; from 6.7 before 6.7.11; and 1 more ranges	NVD
debian debian_linux debian:debian_linux	10.0	NVD

References

References

https://git.kernel.org/stable/c/6d5a9d4a7bcbb7534ce45a18a52e7bd23e69d8ac	patch
https://git.kernel.org/stable/c/54a03e4ac1a41edf8a5087bd59f8241b0de96d3d	patch
https://git.kernel.org/stable/c/d47e6c1932cee02954ea588c9f09fd5ecefeadfc	patch
https://git.kernel.org/stable/c/2e845867b4e279eff0a19ade253390470e07e8a1	patch
https://git.kernel.org/stable/c/a41c8efe659caed0e21422876bbb6b73c15b5244	patch
https://git.kernel.org/stable/c/8c28598a2c29201d2ba7fc37539a7d41c264fb10	patch
https://git.kernel.org/stable/c/2edce8e9a99dd5e4404259d52e754fdc97fb42c2	patch
https://git.kernel.org/stable/c/81137162bfaa7278785b24c1fd2e9e74f082e8e4	patch
https://git.kernel.org/stable/c/68644bf5ec6baaff40fc39b3529c874bfda709bd	patch
https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html	mailing-list, third-party-advisory
1–10 of 12

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.