8 matches found
CVE-2026-64126
A flaw was found in the Linux kernel's Bluetooth Management MGMT subsystem. The handler for the MGMTOPADDEXTADVDATA command does not correctly validate the lengths of extended advertising data and scan response data against the overall command payload. This oversight allows a local attacker with...
CVE-2026-64126
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: validate Add Extended Advertising Data length MGMTOPADDEXTADVDATA is registered as a variable-length command, with MGMTADDEXTADVDATASIZE as the fixed header size. The handler then uses cp-advdatalen and...
CVE-2026-64126
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: validate Add Extended Advertising Data length MGMTOPADDEXTADVDATA is registered as a variable-length command, with MGMTADDEXTADVDATASIZE as the fixed header size. The handler then uses cp-advdatalen and...
EUVD-2026-45811
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: validate Add Extended Advertising Data length MGMTOPADDEXTADVDATA is registered as a variable-length command, with MGMTADDEXTADVDATASIZE as the fixed header size. The handler then uses cp-advdatalen and...
CVE-2026-64126
The CVE-2026-64126 entry concerns the Linux kernel Bluetooth MGMT path for Add Extended Advertising Data. A vulnerability exists where MGMT_OP_ADD_EXT_ADV_DATA is a variable-length command and the fixed-header size plus advertised data lengths are not validated against cp->data, allowing an ou...
CVE-2026-64126 Bluetooth: MGMT: validate Add Extended Advertising Data length
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: validate Add Extended Advertising Data length MGMTOPADDEXTADVDATA is registered as a variable-length command, with MGMTADDEXTADVDATASIZE as the fixed header size. The handler then uses cp-advdatalen and...
CVE-2026-64126 Bluetooth: MGMT: validate Add Extended Advertising Data length
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: validate Add Extended Advertising Data length MGMTOPADDEXTADVDATA is registered as a variable-length command, with MGMTADDEXTADVDATASIZE as the fixed header size. The handler then uses cp-advdatalen and...
PT-2026-61443
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: validate Add Extended Advertising Data length MGMT OP ADD EXT ADV DATA is registered as a variable-length command, with MGMT ADD EXT ADV DATA SIZE as the fixed header size. The handler then uses cp-adv data len a...