CVE-2026-64403

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-64403", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-19T15:36:31.785Z", "datePublished": "2026-07-25T08:50:45.796Z", "dateUpdated": "2026-10-19T20:38:27.125Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T04:55:01.248Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: validate option length before reading conf opt value\n\nl2cap_get_conf_opt() derives the option length from the\nattacker-controlled opt->len field and immediately dereferences\nopt->val (as u8, get_unaligned_le16() or get_unaligned_le32(), or a\nraw pointer for the default case) before any caller has confirmed\nthat opt->len bytes are present in the buffer. The callers\n(l2cap_parse_conf_req(), l2cap_parse_conf_rsp() and\nl2cap_conf_rfc_get()) only detect a malformed option afterwards, once\nthe running length has gone negative, by which point the\nout-of-bounds read has already executed.\n\nAn existing post-hoc length check keeps the garbage value from being\nconsumed, so this is not a data leak in the current control flow. It\nis still a validate-after-use ordering bug: up to 4 bytes are read\npast the end of the buffer before it is known to contain them, and it\nis fragile to future changes in the callers.\n\nFix it at the source. Pass the end of the buffer into\nl2cap_get_conf_opt() and refuse to touch opt->val unless the full\noption (header + value) fits. Each caller computes an end pointer\nonce before the loop and checks the return value directly instead of\ninferring the error from a negative length."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "baseScore": 7.1, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:A - The vulnerable parser processes attacker-controlled BR/EDR L2CAP configuration packets received from a Bluetooth peer within radio range.\nAC:L - A malformed option with a declared length exceeding the remaining buffer directly triggers the invalid read; no race or condition outside the attacker's control is required.\nPR:N - An unauthenticated Bluetooth peer can establish an SDP L2CAP channel, for which Linux bypasses the normal link-security check, and then submit configuration packets.\nUI:N - Once the Bluetooth interface is connectable with an applicable listening service, the peer can establish the channel and send the malformed option without victim action.\nS:U - The vulnerable Bluetooth parser and the resulting kernel impact are within the same host kernel security authority, without crossing a VM, sandbox, or IOMMU boundary.\nC:L - The invalid read is strictly bounded to at most four adjacent bytes. Although the post-hoc check prevents the value from being consumed in the current protocol flow, limited confidentiality impact is the higher defensible choice.\nI:N - The flaw performs only an out-of-bounds read, and the invalid value is discarded before option-specific processing; there is no memory write or control-flow corruption primitive.\nA:H - The invalid kernel read can produce an oops or panic when it reaches an inaccessible or hardened boundary, and an unauthenticated adjacent peer can repeatedly send malformed configuration options."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/bluetooth/l2cap_core.c"], "versions": [{"version": "7c9cbd0b5e38a1672fcd137894ace3b042dfbf69", "lessThan": "cca81b4bc672604a84f6d224a55cc77ec7dee619", "status": "affected", "versionType": "git"}, {"version": "7c9cbd0b5e38a1672fcd137894ace3b042dfbf69", "lessThan": "f70d4aa88068096f35d73e3a05eff33c0a16b9cd", "status": "affected", "versionType": "git"}, {"version": "7c9cbd0b5e38a1672fcd137894ace3b042dfbf69", "lessThan": "7d871e969b941ce25653f7716203a0ea4d07ad4b", "status": "affected", "versionType": "git"}, {"version": "7c9cbd0b5e38a1672fcd137894ace3b042dfbf69", "lessThan": "98d93c226bdfaa79bbdd86981921d7f106374225", "status": "affected", "versionType": "git"}, {"version": "7c9cbd0b5e38a1672fcd137894ace3b042dfbf69", "lessThan": "996d3da39899aceb8f4910911a3f19a45a7d9d1b", "status": "affected", "versionType": "git"}, {"version": "7c9cbd0b5e38a1672fcd137894ace3b042dfbf69", "lessThan": "73abbaf91aa33da87c008fb62c148ade561bb606", "status": "affected", "versionType": "git"}, {"version": "7c9cbd0b5e38a1672fcd137894ace3b042dfbf69", "lessThan": "6b47bdaacfd0045687880177e0987055d8f4765a", "status": "affected", "versionType": "git"}, {"version": "7c9cbd0b5e38a1672fcd137894ace3b042dfbf69", "lessThan": "687617555cedfb74c9e3cb85d759b908dcb17856", "status": "affected", "versionType": "git"}, {"version": "78c2887130f1a7d1883195732be1b6cdab667487", "status": "affected", "versionType": "git"}, {"version": "ac7c597c465eb09391e40febbe088bdad601080b", "status": "affected", "versionType": "git"}, {"version": "ade4560e4fea198866e033fe1c02f063d6d7db2e", "status": "affected", "versionType": "git"}, {"version": "99665dcf6ff803351b5e658f3a929cb498561e36", "status": "affected", "versionType": "git"}, {"version": "2b59d36f22622c92c0b06aee7571f0a86a217188", "status": "affected", "versionType": "git"}, {"version": "15d6538a0d6e0f6de5116081a948cba7cc3e1d3d", "status": "affected", "versionType": "git"}, {"version": "a556547bae00528f24b42786b41a14047db14b84", "status": "affected", "versionType": "git"}, {"version": "3.16.66", "lessThan": "3.17", "status": "affected", "versionType": "semver"}, {"version": "3.18.138", "lessThan": "3.19", "status": "affected", "versionType": "semver"}, {"version": "4.4.178", "lessThan": "4.5", "status": "affected", "versionType": "semver"}, {"version": "4.9.167", "lessThan": "4.10", "status": "affected", "versionType": "semver"}, {"version": "4.14.110", "lessThan": "4.15", "status": "affected", "versionType": "semver"}, {"version": "4.19.33", "lessThan": "4.20", "status": "affected", "versionType": "semver"}, {"version": "5.0.6", "lessThan": "5.1", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/bluetooth/l2cap_core.c"], "versions": [{"version": "5.1", "status": "affected"}, {"version": "0", "lessThan": "5.1", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.261", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.212", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.178", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.145", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.96", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.39", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.4", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.1", "versionEndExcluding": "5.10.261"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.1", "versionEndExcluding": "5.15.212"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.1", "versionEndExcluding": "6.1.178"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.1", "versionEndExcluding": "6.6.145"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.1", "versionEndExcluding": "6.12.96"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.1", "versionEndExcluding": "6.18.39"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.1", "versionEndExcluding": "7.1.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.1", "versionEndExcluding": "7.2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.16.66"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.18.138"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4.178"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9.167"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.14.110"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19.33"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0.6"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/cca81b4bc672604a84f6d224a55cc77ec7dee619"}, {"url": "https://git.kernel.org/stable/c/f70d4aa88068096f35d73e3a05eff33c0a16b9cd"}, {"url": "https://git.kernel.org/stable/c/7d871e969b941ce25653f7716203a0ea4d07ad4b"}, {"url": "https://git.kernel.org/stable/c/98d93c226bdfaa79bbdd86981921d7f106374225"}, {"url": "https://git.kernel.org/stable/c/996d3da39899aceb8f4910911a3f19a45a7d9d1b"}, {"url": "https://git.kernel.org/stable/c/73abbaf91aa33da87c008fb62c148ade561bb606"}, {"url": "https://git.kernel.org/stable/c/6b47bdaacfd0045687880177e0987055d8f4765a"}, {"url": "https://git.kernel.org/stable/c/687617555cedfb74c9e3cb85d759b908dcb17856"}], "title": "Bluetooth: L2CAP: validate option length before reading conf opt value", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-64403", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-16T15:40:12.145113Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125 Out-of-bounds Read"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T20:38:27.125Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-64403", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-16T15:40:12.145113Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125 Out-of-bounds Read"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T15:40:12.760Z"}}], "cna": {"title": "Bluetooth: L2CAP: validate option length before reading conf opt value", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"}, "scenarios": [{"lang": "en", "value": "AV:A - The vulnerable parser processes attacker-controlled BR/EDR L2CAP configuration packets received from a Bluetooth peer within radio range.\nAC:L - A malformed option with a declared length exceeding the remaining buffer directly triggers the invalid read; no race or condition outside the attacker's control is required.\nPR:N - An unauthenticated Bluetooth peer can establish an SDP L2CAP channel, for which Linux bypasses the normal link-security check, and then submit configuration packets.\nUI:N - Once the Bluetooth interface is connectable with an applicable listening service, the peer can establish the channel and send the malformed option without victim action.\nS:U - The vulnerable Bluetooth parser and the resulting kernel impact are within the same host kernel security authority, without crossing a VM, sandbox, or IOMMU boundary.\nC:L - The invalid read is strictly bounded to at most four adjacent bytes. Although the post-hoc check prevents the value from being consumed in the current protocol flow, limited confidentiality impact is the higher defensible choice.\nI:N - The flaw performs only an out-of-bounds read, and the invalid value is discarded before option-specific processing; there is no memory write or control-flow corruption primitive.\nA:H - The invalid kernel read can produce an oops or panic when it reaches an inaccessible or hardened boundary, and an unauthenticated adjacent peer can repeatedly send malformed configuration options."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "7c9cbd0b5e38a1672fcd137894ace3b042dfbf69", "lessThan": "cca81b4bc672604a84f6d224a55cc77ec7dee619", "versionType": "git"}, {"status": "affected", "version": "7c9cbd0b5e38a1672fcd137894ace3b042dfbf69", "lessThan": "f70d4aa88068096f35d73e3a05eff33c0a16b9cd", "versionType": "git"}, {"status": "affected", "version": "7c9cbd0b5e38a1672fcd137894ace3b042dfbf69", "lessThan": "7d871e969b941ce25653f7716203a0ea4d07ad4b", "versionType": "git"}, {"status": "affected", "version": "7c9cbd0b5e38a1672fcd137894ace3b042dfbf69", "lessThan": "98d93c226bdfaa79bbdd86981921d7f106374225", "versionType": "git"}, {"status": "affected", "version": "7c9cbd0b5e38a1672fcd137894ace3b042dfbf69", "lessThan": "996d3da39899aceb8f4910911a3f19a45a7d9d1b", "versionType": "git"}, {"status": "affected", "version": "7c9cbd0b5e38a1672fcd137894ace3b042dfbf69", "lessThan": "73abbaf91aa33da87c008fb62c148ade561bb606", "versionType": "git"}, {"status": "affected", "version": "7c9cbd0b5e38a1672fcd137894ace3b042dfbf69", "lessThan": "6b47bdaacfd0045687880177e0987055d8f4765a", "versionType": "git"}, {"status": "affected", "version": "7c9cbd0b5e38a1672fcd137894ace3b042dfbf69", "lessThan": "687617555cedfb74c9e3cb85d759b908dcb17856", "versionType": "git"}, {"status": "affected", "version": "78c2887130f1a7d1883195732be1b6cdab667487", "versionType": "git"}, {"status": "affected", "version": "ac7c597c465eb09391e40febbe088bdad601080b", "versionType": "git"}, {"status": "affected", "version": "ade4560e4fea198866e033fe1c02f063d6d7db2e", "versionType": "git"}, {"status": "affected", "version": "99665dcf6ff803351b5e658f3a929cb498561e36", "versionType": "git"}, {"status": "affected", "version": "2b59d36f22622c92c0b06aee7571f0a86a217188", "versionType": "git"}, {"status": "affected", "version": "15d6538a0d6e0f6de5116081a948cba7cc3e1d3d", "versionType": "git"}, {"status": "affected", "version": "a556547bae00528f24b42786b41a14047db14b84", "versionType": "git"}, {"status": "affected", "version": "3.16.66", "lessThan": "3.17", "versionType": "semver"}, {"status": "affected", "version": "3.18.138", "lessThan": "3.19", "versionType": "semver"}, {"status": "affected", "version": "4.4.178", "lessThan": "4.5", "versionType": "semver"}, {"status": "affected", "version": "4.9.167", "lessThan": "4.10", "versionType": "semver"}, {"status": "affected", "version": "4.14.110", "lessThan": "4.15", "versionType": "semver"}, {"status": "affected", "version": "4.19.33", "lessThan": "4.20", "versionType": "semver"}, {"status": "affected", "version": "5.0.6", "lessThan": "5.1", "versionType": "semver"}], "programFiles": ["net/bluetooth/l2cap_core.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.1"}, {"status": "unaffected", "version": "0", "lessThan": "5.1", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.261", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.212", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.178", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.145", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.96", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.39", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.4", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/bluetooth/l2cap_core.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/cca81b4bc672604a84f6d224a55cc77ec7dee619"}, {"url": "https://git.kernel.org/stable/c/f70d4aa88068096f35d73e3a05eff33c0a16b9cd"}, {"url": "https://git.kernel.org/stable/c/7d871e969b941ce25653f7716203a0ea4d07ad4b"}, {"url": "https://git.kernel.org/stable/c/98d93c226bdfaa79bbdd86981921d7f106374225"}, {"url": "https://git.kernel.org/stable/c/996d3da39899aceb8f4910911a3f19a45a7d9d1b"}, {"url": "https://git.kernel.org/stable/c/73abbaf91aa33da87c008fb62c148ade561bb606"}, {"url": "https://git.kernel.org/stable/c/6b47bdaacfd0045687880177e0987055d8f4765a"}, {"url": "https://git.kernel.org/stable/c/687617555cedfb74c9e3cb85d759b908dcb17856"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: validate option length before reading conf opt value\n\nl2cap_get_conf_opt() derives the option length from the\nattacker-controlled opt->len field and immediately dereferences\nopt->val (as u8, get_unaligned_le16() or get_unaligned_le32(), or a\nraw pointer for the default case) before any caller has confirmed\nthat opt->len bytes are present in the buffer. The callers\n(l2cap_parse_conf_req(), l2cap_parse_conf_rsp() and\nl2cap_conf_rfc_get()) only detect a malformed option afterwards, once\nthe running length has gone negative, by which point the\nout-of-bounds read has already executed.\n\nAn existing post-hoc length check keeps the garbage value from being\nconsumed, so this is not a data leak in the current control flow. It\nis still a validate-after-use ordering bug: up to 4 bytes are read\npast the end of the buffer before it is known to contain them, and it\nis fragile to future changes in the callers.\n\nFix it at the source. Pass the end of the buffer into\nl2cap_get_conf_opt() and refuse to touch opt->val unless the full\noption (header + value) fits. Each caller computes an end pointer\nonce before the loop and checks the return value directly instead of\ninferring the error from a negative length."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.261", "versionStartIncluding": "5.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.212", "versionStartIncluding": "5.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.178", "versionStartIncluding": "5.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.145", "versionStartIncluding": "5.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.96", "versionStartIncluding": "5.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.39", "versionStartIncluding": "5.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1.4", "versionStartIncluding": "5.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.2", "versionStartIncluding": "5.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "3.16.66"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "3.18.138"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "4.4.178"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "4.9.167"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "4.14.110"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "4.19.33"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "5.0.6"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T04:55:01.248Z"}}}, "cveMetadata": {"cveId": "CVE-2026-64403", "state": "PUBLISHED", "dateUpdated": "2026-10-19T20:38:27.125Z", "dateReserved": "2026-07-19T15:36:31.785Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-07-25T08:50:45.796Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/bluetooth/l2cap_core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "cca81b4bc672604a84f6d224a55cc77ec7dee619", "status": "affected", "version": "7c9cbd0b5e38a1672fcd137894ace3b042dfbf69", "versionType": "git"}, {"lessThan": "f70d4aa88068096f35d73e3a05eff33c0a16b9cd", "status": "affected", "version": "7c9cbd0b5e38a1672fcd137894ace3b042dfbf69", "versionType": "git"}, {"lessThan": "7d871e969b941ce25653f7716203a0ea4d07ad4b", "status": "affected", "version": "7c9cbd0b5e38a1672fcd137894ace3b042dfbf69", "versionType": "git"}, {"lessThan": "98d93c226bdfaa79bbdd86981921d7f106374225", "status": "affected", "version": "7c9cbd0b5e38a1672fcd137894ace3b042dfbf69", "versionType": "git"}, {"lessThan": "996d3da39899aceb8f4910911a3f19a45a7d9d1b", "status": "affected", "version": "7c9cbd0b5e38a1672fcd137894ace3b042dfbf69", "versionType": "git"}, {"lessThan": "73abbaf91aa33da87c008fb62c148ade561bb606", "status": "affected", "version": "7c9cbd0b5e38a1672fcd137894ace3b042dfbf69", "versionType": "git"}, {"lessThan": "6b47bdaacfd0045687880177e0987055d8f4765a", "status": "affected", "version": "7c9cbd0b5e38a1672fcd137894ace3b042dfbf69", "versionType": "git"}, {"lessThan": "687617555cedfb74c9e3cb85d759b908dcb17856", "status": "affected", "version": "7c9cbd0b5e38a1672fcd137894ace3b042dfbf69", "versionType": "git"}, {"status": "affected", "version": "78c2887130f1a7d1883195732be1b6cdab667487", "versionType": "git"}, {"status": "affected", "version": "ac7c597c465eb09391e40febbe088bdad601080b", "versionType": "git"}, {"status": "affected", "version": "ade4560e4fea198866e033fe1c02f063d6d7db2e", "versionType": "git"}, {"status": "affected", "version": "99665dcf6ff803351b5e658f3a929cb498561e36", "versionType": "git"}, {"status": "affected", "version": "2b59d36f22622c92c0b06aee7571f0a86a217188", "versionType": "git"}, {"status": "affected", "version": "15d6538a0d6e0f6de5116081a948cba7cc3e1d3d", "versionType": "git"}, {"status": "affected", "version": "a556547bae00528f24b42786b41a14047db14b84", "versionType": "git"}, {"lessThan": "3.17", "status": "affected", "version": "3.16.66", "versionType": "semver"}, {"lessThan": "3.19", "status": "affected", "version": "3.18.138", "versionType": "semver"}, {"lessThan": "4.5", "status": "affected", "version": "4.4.178", "versionType": "semver"}, {"lessThan": "4.10", "status": "affected", "version": "4.9.167", "versionType": "semver"}, {"lessThan": "4.15", "status": "affected", "version": "4.14.110", "versionType": "semver"}, {"lessThan": "4.20", "status": "affected", "version": "4.19.33", "versionType": "semver"}, {"lessThan": "5.1", "status": "affected", "version": "5.0.6", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/bluetooth/l2cap_core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.1"}, {"lessThan": "5.1", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.261", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.212", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.178", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.145", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.96", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.39", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "EAFB90C8-E6AC-40FC-B718-C6569511F43B", "versionEndExcluding": "3.17", "versionStartIncluding": "3.16.66", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "F833EC2A-D0F3-4B78-ACB8-05D2EF98BAC3", "versionEndExcluding": "3.19", "versionStartIncluding": "3.18.138", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "A722E651-3556-4E10-9B6A-7D0CE8D0C5D7", "versionEndExcluding": "4.5", "versionStartIncluding": "4.4.178", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "5A810207-8023-4209-95E1-F4608AD30BC2", "versionEndExcluding": "4.10", "versionStartIncluding": "4.9.167", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "9D307FAA-524F-4DDE-A789-61E8ACCBCB69", "versionEndExcluding": "4.15", "versionStartIncluding": "4.14.110", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "1C615A8F-45B4-4CC3-9024-95838A7048AC", "versionEndExcluding": "4.20", "versionStartIncluding": "4.19.33", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "67AA953F-BE56-4173-9237-969D0FAF963B", "versionEndExcluding": "5.10.261", "versionStartIncluding": "5.0.6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "8E99FB01-CD93-41AF-A653-3F450652B9A6", "versionEndExcluding": "5.15.212", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "092233C7-F4E0-40C8-BD4D-A28FE50DFE20", "versionEndExcluding": "6.1.178", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "7046B092-F810-4440-ACE6-60218518EECE", "versionEndExcluding": "6.6.145", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "38A8100E-2B1A-462F-AEE9-8901B870FEF2", "versionEndExcluding": "6.12.96", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "914AE4BC-3D59-4C5A-9DB5-9CE327B429F7", "versionEndExcluding": "6.18.39", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "6228DDD6-4557-4AA3-9F43-AB995D471E42", "versionEndExcluding": "7.1.4", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.2:rc1:*:*:*:*:*:*", "matchCriteriaId": "5E8B9085-7ADB-4A05-89EF-12949B6A0509", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.2:rc2:*:*:*:*:*:*", "matchCriteriaId": "1FC0D50D-9D58-4947-A197-A5A3FF07E7E3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: validate option length before reading conf opt value\n\nl2cap_get_conf_opt() derives the option length from the\nattacker-controlled opt->len field and immediately dereferences\nopt->val (as u8, get_unaligned_le16() or get_unaligned_le32(), or a\nraw pointer for the default case) before any caller has confirmed\nthat opt->len bytes are present in the buffer. The callers\n(l2cap_parse_conf_req(), l2cap_parse_conf_rsp() and\nl2cap_conf_rfc_get()) only detect a malformed option afterwards, once\nthe running length has gone negative, by which point the\nout-of-bounds read has already executed.\n\nAn existing post-hoc length check keeps the garbage value from being\nconsumed, so this is not a data leak in the current control flow. It\nis still a validate-after-use ordering bug: up to 4 bytes are read\npast the end of the buffer before it is known to contain them, and it\nis fragile to future changes in the callers.\n\nFix it at the source. Pass the end of the buffer into\nl2cap_get_conf_opt() and refuse to touch opt->val unless the full\noption (header + value) fits. Each caller computes an end pointer\nonce before the loop and checks the return value directly instead of\ninferring the error from a negative length."}], "id": "CVE-2026-64403", "lastModified": "2026-10-19T21:17:35.757", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.2, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-64403", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T15:40:12.145113Z", "version": "2.0.3"}}]}, "published": "2026-07-25T10:17:23.850", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/687617555cedfb74c9e3cb85d759b908dcb17856"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/6b47bdaacfd0045687880177e0987055d8f4765a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/73abbaf91aa33da87c008fb62c148ade561bb606"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/7d871e969b941ce25653f7716203a0ea4d07ad4b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/98d93c226bdfaa79bbdd86981921d7f106374225"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/996d3da39899aceb8f4910911a3f19a45a7d9d1b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/cca81b4bc672604a84f6d224a55cc77ec7dee619"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f70d4aa88068096f35d73e3a05eff33c0a16b9cd"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-476"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-125"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: Bluetooth: L2CAP: validate option length before reading conf opt value", "id": "2507242", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507242"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-805", "details": ["A flaw was found in the Bluetooth L2CAP (Logical Link Control and Adaptation Protocol) component of the Linux kernel. The `l2cap_get_conf_opt()` function, responsible for processing configuration options, does not properly validate the length of an option before attempting to read its value. This allows an attacker to control the option length, potentially leading to an out-of-bounds read of up to 4 bytes past the end of a buffer. Although current safeguards prevent immediate data leakage, this vulnerability represents a critical validate-after-use ordering bug that could be exploited in future system configurations."], "name": "CVE-2026-64403", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-07-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-64403\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-64403\nhttps://lore.kernel.org/linux-cve-announce/2026072530-CVE-2026-64403-31f1@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[7c9cbd0b5e38a1672fcd137894ace3b042dfbf69,cca81b4bc672604a84f6d224a55cc77ec7dee619)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[7c9cbd0b5e38a1672fcd137894ace3b042dfbf69,f70d4aa88068096f35d73e3a05eff33c0a16b9cd)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[7c9cbd0b5e38a1672fcd137894ace3b042dfbf69,7d871e969b941ce25653f7716203a0ea4d07ad4b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[7c9cbd0b5e38a1672fcd137894ace3b042dfbf69,98d93c226bdfaa79bbdd86981921d7f106374225)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[7c9cbd0b5e38a1672fcd137894ace3b042dfbf69,996d3da39899aceb8f4910911a3f19a45a7d9d1b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[7c9cbd0b5e38a1672fcd137894ace3b042dfbf69,73abbaf91aa33da87c008fb62c148ade561bb606)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[7c9cbd0b5e38a1672fcd137894ace3b042dfbf69,6b47bdaacfd0045687880177e0987055d8f4765a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[7c9cbd0b5e38a1672fcd137894ace3b042dfbf69,687617555cedfb74c9e3cb85d759b908dcb17856)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "78c2887130f1a7d1883195732be1b6cdab667487"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "ac7c597c465eb09391e40febbe088bdad601080b"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "ade4560e4fea198866e033fe1c02f063d6d7db2e"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "99665dcf6ff803351b5e658f3a929cb498561e36"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "2b59d36f22622c92c0b06aee7571f0a86a217188"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "15d6538a0d6e0f6de5116081a948cba7cc3e1d3d"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "a556547bae00528f24b42786b41a14047db14b84"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.16.66,3.17)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.18.138,3.19)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.4.178,4.5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.9.167,4.10)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.14.110,4.15)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.19.33,4.20)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.0.6,5.1)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.1"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,5.1)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.10.261,5.10.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.212,5.15.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.178,6.1.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.145,6.6.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.96,6.12.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.39,6.18.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.4,7.1.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2-rc3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-07-26T05:15:11.925487+00:00", "updated": "2026-10-20T13:45:13.302772+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}