CVE-2026-64549

A flaw was found in the Linux kernel's Bluetooth bpa10x driver. This vulnerability allows a malicious Bluetooth device to trigger an out-of-bounds read in the bpa10xsetup function by sending a specially crafted one-byte or non-NUL-terminated response. This can lead to information disclosure, wher...

CVE-2026-64549

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bpa10x: avoid OOB read of revision string in bpa10xsetup bpa10xsetup sends the vendor command 0xfc0e and passes the response to btdevinfo and hcisetfwinfo as a "%s" string starting at skb-data + 1, without checking the...

CVE-2026-64549 Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bpa10x: avoid OOB read of revision string in bpa10xsetup bpa10xsetup sends the vendor command 0xfc0e and passes the response to btdevinfo and hcisetfwinfo as a "%s" string starting at skb-data + 1, without checking the...