Bluetooth: eir: Fix stack OOB write when prepending the Flags AD
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: eir: Fix stack OOB write when prepending the Flags AD eir_create_adv_data() builds the advertising data into a fixed-size buffer ("size", 31 for the legacy path). It may prepend a 3-byte "Flags" AD structure (LE_AD_NO_BREDR on an LE-only controller) and then copies the per-instance data without checking that it still fits: memcpy(ptr, adv->adv_data, adv->adv_data_len); tlv_data_max_len() only reserves those 3 bytes when the user-supplied flags carry a managed-flags bit, so an instance added with flags == 0 is accepted with adv_data_len up to the full buffer. At advertise time the flags are still prepended, and the memcpy() writes 3 + adv_data_len bytes into the size-byte buffer: BUG: KASAN: stack-out-of-bounds in eir_create_adv_data (net/bluetooth/eir.c:301) Write of size 31 at addr ffff88800a547bdc by task kworker/u9:0/65 Workqueue: hci0 hci_cmd_sync_work __asan_memcpy (mm/kasan/shadow.c:106) eir_create_adv_data (net/bluetooth/eir.c:301) hci_update_adv_data_sync (net/bluetooth/hci_sync.c:1310) hci_schedule_adv_instance_sync (net/bluetooth/hci_sync.c:1817) hci_cmd_sync_work (net/bluetooth/hci_sync.c:332) This frame has 1 object: [32, 64) 'cp' The "Flags" structure is added by the kernel, not requested by userspace, so only prepend it when it fits together with the instance advertising data; when there is no room for both, drop the flags rather than the user-provided data. Reachable by a local user
CVE-2026-64539
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-64539
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "b44133ff03be30b55f23036e62f403a3f7784fce",
"lessThan": "0f0b6232af56441d0a2dcb173cc4f8d8aab39014",
"versionType": "git"
},
{
"status": "affected",
"version": "b44133ff03be30b55f23036e62f403a3f7784fce",
"lessThan": "9174992ee1045c9c96e53eecda64f49dd7e8fbba",
"versionType": "git"
},
{
"status": "affected",
"version": "b44133ff03be30b55f23036e62f403a3f7784fce",
"lessThan": "09301f1fdf2aef8cce34d0c4650c30e7edb1ced9",
"versionType": "git"
},
{
"status": "affected",
"version": "b44133ff03be30b55f23036e62f403a3f7784fce",
"lessThan": "f1b4df9c260c51726da2e86e19322825fddeefd0",
"versionType": "git"
},
{
"status": "affected",
"version": "b44133ff03be30b55f23036e62f403a3f7784fce",
"lessThan": "57077eeb586c42f124bc09e018449362223067b3",
"versionType": "git"
},
{
"status": "affected",
"version": "b44133ff03be30b55f23036e62f403a3f7784fce",
"lessThan": "6f5fb689fdf80bdd143f22a502f9eb1f3c85e286",
"versionType": "git"
}
],
"programFiles": [
"net/bluetooth/eir.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "4.1"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "4.1",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver",
"lessThanOrEqual": "7.1.*"
},
{
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"net/bluetooth/eir.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-64539
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #46442 · Revision 1
- Added to Heist Feed
- Publisher date