CVE-2026-74509

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: Fix advertising data UAFs hcifindadvinstance returns an advinfo pointer that is valid only while hdev-lock is held. The advertising command-sync paths perform instance lookups without that lock and, in some...

PT-2026-72961

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci sync: Fix advertising data UAFs hci find adv instance returns an adv info pointer that is valid only while hdev-lock is held. The advertising command-sync paths perform instance lookups without that lock and, in so...

Linux Distros Unpatched Vulnerability : CVE-2026-64539

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: eir: Fix stack OOB write when prepending the Flags AD eircreateadvdata builds the advertising data into a fixed-size buffer size, 31 for the legacy...

CVE-2026-64539

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: eir: Fix stack OOB write when prepending the Flags AD eircreateadvdata builds the advertising data into a fixed-size buffer "size", 31 for the legacy path. It may prepend a 3-byte "Flags" AD structure LEADNOBREDR on an...

CVE-2026-64539

Linux kernel Bluetooth EIR code (eir_create_adv_data) has a stack-based OOB write vulnerability when prepending a 3-byte Flags AD to advertising data in a fixed-size 31-byte legacy buffer. If adv_data_len approaches the limit and the Flags structure is not fully accommodated, the code can memcpy ...

CVE-2026-64539 Bluetooth: eir: Fix stack OOB write when prepending the Flags AD

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: eir: Fix stack OOB write when prepending the Flags AD eircreateadvdata builds the advertising data into a fixed-size buffer "size", 31 for the legacy path. It may prepend a 3-byte "Flags" AD structure LEADNOBREDR on an...

SUSE CVE-2026-64126

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: validate Add Extended Advertising Data length MGMTOPADDEXTADVDATA is registered as a variable-length command, with MGMTADDEXTADVDATASIZE as the fixed header size. The handler then uses cp-advdatalen and...

CVE-2026-64126

A flaw was found in the Linux kernel's Bluetooth Management MGMT subsystem. The handler for the MGMTOPADDEXTADVDATA command does not correctly validate the lengths of extended advertising data and scan response data against the overall command payload. This oversight allows a local attacker with...

Linux Distros Unpatched Vulnerability : CVE-2026-64126

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: MGMT: validate Add Extended Advertising Data length MGMTOPADDEXTADVDATA is registered as a variable-length command, with MGMTADDEXTADVDATASIZE as the...

CVE-2026-64126

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: validate Add Extended Advertising Data length MGMTOPADDEXTADVDATA is registered as a variable-length command, with MGMTADDEXTADVDATASIZE as the fixed header size. The handler then uses cp-advdatalen and...

CVE-2026-64126

The CVE-2026-64126 entry concerns the Linux kernel Bluetooth MGMT path for Add Extended Advertising Data. A vulnerability exists where MGMT_OP_ADD_EXT_ADV_DATA is a variable-length command and the fixed-header size plus advertised data lengths are not validated against cp->data, allowing an ou...

CVE-2026-64126 Bluetooth: MGMT: validate Add Extended Advertising Data length

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: validate Add Extended Advertising Data length MGMTOPADDEXTADVDATA is registered as a variable-length command, with MGMTADDEXTADVDATASIZE as the fixed header size. The handler then uses cp-advdatalen and...

EUVD-2026-45811

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: validate Add Extended Advertising Data length MGMTOPADDEXTADVDATA is registered as a variable-length command, with MGMTADDEXTADVDATASIZE as the fixed header size. The handler then uses cp-advdatalen and...

CVE-2026-64126

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: validate Add Extended Advertising Data length MGMTOPADDEXTADVDATA is registered as a variable-length command, with MGMTADDEXTADVDATASIZE as the fixed header size. The handler then uses cp-advdatalen and...

CVE-2026-64126 Bluetooth: MGMT: validate Add Extended Advertising Data length

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: validate Add Extended Advertising Data length MGMTOPADDEXTADVDATA is registered as a variable-length command, with MGMTADDEXTADVDATASIZE as the fixed header size. The handler then uses cp-advdatalen and...

CVE-2026-64126

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: validate Add Extended Advertising Data length MGMTOPADDEXTADVDATA is registered as a variable-length command, with MGMTADDEXTADVDATASIZE as the fixed header size. The handler then uses cp-advdatalen and...

PT-2026-61443

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Bluetooth MGMT component where the MGMT OP ADD EXT ADV DATA command fails to verify if the specified advertising data lengths are within the actual command payload...

SUSE CVE-2026-53255

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: validate advertising TLV before type checks tlvdataisvalid reads each advertising data field length from datai, then inspects datai + 1 for managed EIR types before checking that the current field still fits insi...

CVE-2026-53255

A flaw was found in the Linux kernel's Bluetooth Management MGMT component. A remote attacker could exploit this by providing specially crafted advertising data, leading to an out-of-bounds read vulnerability. This occurs because the system incorrectly validates the length of advertising data...

CVE-2026-53255

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: validate advertising TLV before type checks tlvdataisvalid reads each advertising data field length from datai, then inspects datai + 1 for managed EIR types before checking that the current field still fits insi...