High 7.3Published Jul 19, 2026

CVE-2026-64126Bluetooth: MGMT: validate Add Extended Advertising Data length

Updated under an hour ago (Oct 27, 2026, 10:00 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: validate Add Extended Advertising Data length MGMT_OP_ADD_EXT_ADV_DATA is registered as a variable-length command, with MGMT_ADD_EXT_ADV_DATA_SIZE as the fixed header size. The handler then uses cp->adv_data_len and cp->scan_rsp_len to validate and copy cp->data, but it never checks that those bytes are part of the mgmt command payload. A short command can therefore make add_ext_adv_data() pass an out-of-bounds pointer into tlv_data_is_valid(). If the bytes beyond the command buffer are addressable, they can also be copied into the advertising instance as scan response data, where the caller can read them back via MGMT_OP_GET_ADV_INSTANCE. The trigger requires CAP_NET_ADMIN in the initial user namespace; KASAN reports an 8-byte slab-out-of-bounds read. Reject commands whose length does not match the fixed header plus both advertising data lengths before parsing cp->data.

CVSS: 7.3 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Weakness (CWE): CWE-125
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	12410572833a283ce92fcf9679ca8a2f372097ee builds before 0d5104390b445e7bd664ad583837e4c04d892c9d; 12410572833a283ce92fcf9679ca8a2f372097ee builds before 14b01b9cba04e6ce82825f68fc4c4322fa4ffa43; from 12410572833a283ce92fcf9679ca8a2f372097ee before a143ce77a5292f2c9285137433d879ce71d190a7; from 12410572833a283ce92fcf9679ca8a2f372097ee before a6c75a3fad226ccbd8ef9110dee87c92c299f2ab; from 12410572833a283ce92fcf9679ca8a2f372097ee before f1febe93ef075314615f970a87681d9ab86691d1; 12410572833a283ce92fcf9679ca8a2f372097ee builds before 0bc1a5a69f541859293d79db72bd7854ac48df51; from 12410572833a283ce92fcf9679ca8a2f372097ee before d3f7d17960ed50df3a6709c5158caff989c8c905	CNA record
linux linux_kernel linux:linux_kernel	from 5.11 before 5.15.210; from 5.16 before 6.1.175; from 6.2 before 6.6.142; from 6.7 before 6.12.92; from 6.13 before 6.18.34; from 6.19 before 7.0.11; 7.1; 7.1; and 2 more ranges	NVD

References

References

https://git.kernel.org/stable/c/0d5104390b445e7bd664ad583837e4c04d892c9d	patch
https://git.kernel.org/stable/c/14b01b9cba04e6ce82825f68fc4c4322fa4ffa43	patch
https://git.kernel.org/stable/c/a143ce77a5292f2c9285137433d879ce71d190a7	patch
https://git.kernel.org/stable/c/a6c75a3fad226ccbd8ef9110dee87c92c299f2ab	patch
https://git.kernel.org/stable/c/f1febe93ef075314615f970a87681d9ab86691d1	patch
https://git.kernel.org/stable/c/0bc1a5a69f541859293d79db72bd7854ac48df51	patch
https://git.kernel.org/stable/c/d3f7d17960ed50df3a6709c5158caff989c8c905	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.