CVE-2026-64539

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-64539", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-19T15:36:31.795Z", "datePublished": "2026-07-27T20:10:33.363Z", "dateUpdated": "2026-10-21T12:43:26.591Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-21T12:43:26.591Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: eir: Fix stack OOB write when prepending the Flags AD\n\neir_create_adv_data() builds the advertising data into a fixed-size\nbuffer (\"size\", 31 for the legacy path). It may prepend a 3-byte \"Flags\"\nAD structure (LE_AD_NO_BREDR on an LE-only controller) and then copies\nthe per-instance data without checking that it still fits:\n\n\tmemcpy(ptr, adv->adv_data, adv->adv_data_len);\n\ntlv_data_max_len() only reserves those 3 bytes when the user-supplied\nflags carry a managed-flags bit, so an instance added with flags == 0 is\naccepted with adv_data_len up to the full buffer. At advertise time the\nflags are still prepended, and the memcpy() writes 3 + adv_data_len\nbytes into the size-byte buffer:\n\n BUG: KASAN: stack-out-of-bounds in eir_create_adv_data (net/bluetooth/eir.c:301)\n Write of size 31 at addr ffff88800a547bdc by task kworker/u9:0/65\n Workqueue: hci0 hci_cmd_sync_work\n __asan_memcpy (mm/kasan/shadow.c:106)\n eir_create_adv_data (net/bluetooth/eir.c:301)\n hci_update_adv_data_sync (net/bluetooth/hci_sync.c:1310)\n hci_schedule_adv_instance_sync (net/bluetooth/hci_sync.c:1817)\n hci_cmd_sync_work (net/bluetooth/hci_sync.c:332)\n This frame has 1 object:\n [32, 64) 'cp'\n\nThe \"Flags\" structure is added by the kernel, not requested by\nuserspace, so only prepend it when it fits together with the instance\nadvertising data; when there is no room for both, drop the flags rather\nthan the user-provided data.\n\nReachable by a local user with CAP_NET_ADMIN owning an LE-only\ncontroller on the legacy advertising path."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The overflow is driven entirely by locally supplied advertising data written to an AF_BLUETOOTH HCI control socket (MGMT_OP_ADD_ADVERTISING / ADD_EXT_ADV_DATA / MESH_SEND); no remote or adjacent Bluetooth peer can influence the length or contents. Consistent with the same-class CVE-2026-53209 and CVE-2026-64126, this is a local-only trigger.\nAC:L - The attacker fully controls both preconditions \u2014 submit an instance with flags==0 and adv_data_len at the maximum, containing no EIR_FLAGS element \u2014 and the kernel then deterministically prepends the 3-byte Flags AD on any LE-only controller. No race, no memory-layout luck, no retry needed.\nPR:L - Reaching the mgmt handler requires HCI_SOCK_TRUSTED, granted by CAP_NET_ADMIN, which is a delegated capability routinely held by the Bluetooth stack daemon rather than full system root, and this CNA scores the identical CAP_NET_ADMIN-gated Bluetooth mgmt paths (CVE-2026-64126, CVE-2026-53209, CVE-2026-31511) as PR:L. Choosing the higher-severity option where the privilege boundary is arguable.\nUI:N - The attacker issues the mgmt commands itself and the overflow fires from hci_cmd_sync_work when the instance is scheduled for advertising. No victim action of any kind is involved.\nS:U - The corruption is confined to the kernel's own stack within the same security authority; there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - On the extended-advertising path the inflated length (254 > 251) makes struct_size() copy 3 bytes of adjacent kernel stack past the DEFINE_FLEX pdu into the HCI command skb, which is exposed via the HCI monitor channel and handed to the controller for broadcast, and the stack corruption is generally leverageable for further disclosure.\nI:H - This is an out-of-bounds write of fully attacker-controlled bytes (the tail of the user-supplied adv_data) past a local stack object, and it additionally leaves hdev->adv_data_len set to a value larger than the data actually stored. An attacker-controlled linear stack overflow is treated as high integrity impact.\nA:H - Overwriting bytes immediately past the stack object corrupts adjacent frame state and, with CONFIG_STACKPROTECTOR, will trip __stack_chk_fail leading to a kernel panic; the reported KASAN stack-out-of-bounds confirms real memory corruption in hci_cmd_sync_work."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/bluetooth/eir.c"], "versions": [{"version": "b44133ff03be30b55f23036e62f403a3f7784fce", "lessThan": "0f0b6232af56441d0a2dcb173cc4f8d8aab39014", "status": "affected", "versionType": "git"}, {"version": "b44133ff03be30b55f23036e62f403a3f7784fce", "lessThan": "9174992ee1045c9c96e53eecda64f49dd7e8fbba", "status": "affected", "versionType": "git"}, {"version": "b44133ff03be30b55f23036e62f403a3f7784fce", "lessThan": "09301f1fdf2aef8cce34d0c4650c30e7edb1ced9", "status": "affected", "versionType": "git"}, {"version": "b44133ff03be30b55f23036e62f403a3f7784fce", "lessThan": "f1b4df9c260c51726da2e86e19322825fddeefd0", "status": "affected", "versionType": "git"}, {"version": "b44133ff03be30b55f23036e62f403a3f7784fce", "lessThan": "57077eeb586c42f124bc09e018449362223067b3", "status": "affected", "versionType": "git"}, {"version": "b44133ff03be30b55f23036e62f403a3f7784fce", "lessThan": "6f5fb689fdf80bdd143f22a502f9eb1f3c85e286", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/bluetooth/eir.c"], "versions": [{"version": "4.1", "status": "affected"}, {"version": "0", "lessThan": "4.1", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.178", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.97", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.40", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.1", "versionEndExcluding": "6.1.178"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.1", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.1", "versionEndExcluding": "6.12.97"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.1", "versionEndExcluding": "6.18.40"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.1", "versionEndExcluding": "7.1.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.1", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/0f0b6232af56441d0a2dcb173cc4f8d8aab39014"}, {"url": "https://git.kernel.org/stable/c/9174992ee1045c9c96e53eecda64f49dd7e8fbba"}, {"url": "https://git.kernel.org/stable/c/09301f1fdf2aef8cce34d0c4650c30e7edb1ced9"}, {"url": "https://git.kernel.org/stable/c/f1b4df9c260c51726da2e86e19322825fddeefd0"}, {"url": "https://git.kernel.org/stable/c/57077eeb586c42f124bc09e018449362223067b3"}, {"url": "https://git.kernel.org/stable/c/6f5fb689fdf80bdd143f22a502f9eb1f3c85e286"}], "title": "Bluetooth: eir: Fix stack OOB write when prepending the Flags AD", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-64539", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:42:00.875042Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-121", "description": "CWE-121 Stack-based Buffer Overflow"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T20:48:39.300Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-64539", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:42:00.875042Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-121", "description": "CWE-121 Stack-based Buffer Overflow"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T15:42:02.409Z"}}], "cna": {"title": "Bluetooth: eir: Fix stack OOB write when prepending the Flags AD", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The overflow is driven entirely by locally supplied advertising data written to an AF_BLUETOOTH HCI control socket (MGMT_OP_ADD_ADVERTISING / ADD_EXT_ADV_DATA / MESH_SEND); no remote or adjacent Bluetooth peer can influence the length or contents. Consistent with the same-class CVE-2026-53209 and CVE-2026-64126, this is a local-only trigger.\nAC:L - The attacker fully controls both preconditions \u2014 submit an instance with flags==0 and adv_data_len at the maximum, containing no EIR_FLAGS element \u2014 and the kernel then deterministically prepends the 3-byte Flags AD on any LE-only controller. No race, no memory-layout luck, no retry needed.\nPR:L - Reaching the mgmt handler requires HCI_SOCK_TRUSTED, granted by CAP_NET_ADMIN, which is a delegated capability routinely held by the Bluetooth stack daemon rather than full system root, and this CNA scores the identical CAP_NET_ADMIN-gated Bluetooth mgmt paths (CVE-2026-64126, CVE-2026-53209, CVE-2026-31511) as PR:L. Choosing the higher-severity option where the privilege boundary is arguable.\nUI:N - The attacker issues the mgmt commands itself and the overflow fires from hci_cmd_sync_work when the instance is scheduled for advertising. No victim action of any kind is involved.\nS:U - The corruption is confined to the kernel's own stack within the same security authority; there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - On the extended-advertising path the inflated length (254 > 251) makes struct_size() copy 3 bytes of adjacent kernel stack past the DEFINE_FLEX pdu into the HCI command skb, which is exposed via the HCI monitor channel and handed to the controller for broadcast, and the stack corruption is generally leverageable for further disclosure.\nI:H - This is an out-of-bounds write of fully attacker-controlled bytes (the tail of the user-supplied adv_data) past a local stack object, and it additionally leaves hdev->adv_data_len set to a value larger than the data actually stored. An attacker-controlled linear stack overflow is treated as high integrity impact.\nA:H - Overwriting bytes immediately past the stack object corrupts adjacent frame state and, with CONFIG_STACKPROTECTOR, will trip __stack_chk_fail leading to a kernel panic; the reported KASAN stack-out-of-bounds confirms real memory corruption in hci_cmd_sync_work."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "b44133ff03be30b55f23036e62f403a3f7784fce", "lessThan": "0f0b6232af56441d0a2dcb173cc4f8d8aab39014", "versionType": "git"}, {"status": "affected", "version": "b44133ff03be30b55f23036e62f403a3f7784fce", "lessThan": "9174992ee1045c9c96e53eecda64f49dd7e8fbba", "versionType": "git"}, {"status": "affected", "version": "b44133ff03be30b55f23036e62f403a3f7784fce", "lessThan": "09301f1fdf2aef8cce34d0c4650c30e7edb1ced9", "versionType": "git"}, {"status": "affected", "version": "b44133ff03be30b55f23036e62f403a3f7784fce", "lessThan": "f1b4df9c260c51726da2e86e19322825fddeefd0", "versionType": "git"}, {"status": "affected", "version": "b44133ff03be30b55f23036e62f403a3f7784fce", "lessThan": "57077eeb586c42f124bc09e018449362223067b3", "versionType": "git"}, {"status": "affected", "version": "b44133ff03be30b55f23036e62f403a3f7784fce", "lessThan": "6f5fb689fdf80bdd143f22a502f9eb1f3c85e286", "versionType": "git"}], "programFiles": ["net/bluetooth/eir.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.1"}, {"status": "unaffected", "version": "0", "lessThan": "4.1", "versionType": "semver"}, {"status": "unaffected", "version": "6.1.178", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.160", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.97", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.40", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.5", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/bluetooth/eir.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/0f0b6232af56441d0a2dcb173cc4f8d8aab39014"}, {"url": "https://git.kernel.org/stable/c/9174992ee1045c9c96e53eecda64f49dd7e8fbba"}, {"url": "https://git.kernel.org/stable/c/09301f1fdf2aef8cce34d0c4650c30e7edb1ced9"}, {"url": "https://git.kernel.org/stable/c/f1b4df9c260c51726da2e86e19322825fddeefd0"}, {"url": "https://git.kernel.org/stable/c/57077eeb586c42f124bc09e018449362223067b3"}, {"url": "https://git.kernel.org/stable/c/6f5fb689fdf80bdd143f22a502f9eb1f3c85e286"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: eir: Fix stack OOB write when prepending the Flags AD\n\neir_create_adv_data() builds the advertising data into a fixed-size\nbuffer (\"size\", 31 for the legacy path). It may prepend a 3-byte \"Flags\"\nAD structure (LE_AD_NO_BREDR on an LE-only controller) and then copies\nthe per-instance data without checking that it still fits:\n\n\tmemcpy(ptr, adv->adv_data, adv->adv_data_len);\n\ntlv_data_max_len() only reserves those 3 bytes when the user-supplied\nflags carry a managed-flags bit, so an instance added with flags == 0 is\naccepted with adv_data_len up to the full buffer. At advertise time the\nflags are still prepended, and the memcpy() writes 3 + adv_data_len\nbytes into the size-byte buffer:\n\n BUG: KASAN: stack-out-of-bounds in eir_create_adv_data (net/bluetooth/eir.c:301)\n Write of size 31 at addr ffff88800a547bdc by task kworker/u9:0/65\n Workqueue: hci0 hci_cmd_sync_work\n __asan_memcpy (mm/kasan/shadow.c:106)\n eir_create_adv_data (net/bluetooth/eir.c:301)\n hci_update_adv_data_sync (net/bluetooth/hci_sync.c:1310)\n hci_schedule_adv_instance_sync (net/bluetooth/hci_sync.c:1817)\n hci_cmd_sync_work (net/bluetooth/hci_sync.c:332)\n This frame has 1 object:\n [32, 64) 'cp'\n\nThe \"Flags\" structure is added by the kernel, not requested by\nuserspace, so only prepend it when it fits together with the instance\nadvertising data; when there is no room for both, drop the flags rather\nthan the user-provided data.\n\nReachable by a local user with CAP_NET_ADMIN owning an LE-only\ncontroller on the legacy advertising path."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.178", "versionStartIncluding": "4.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.160", "versionStartIncluding": "4.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.97", "versionStartIncluding": "4.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.40", "versionStartIncluding": "4.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1.5", "versionStartIncluding": "4.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.2", "versionStartIncluding": "4.1"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-21T12:43:26.591Z"}}}, "cveMetadata": {"cveId": "CVE-2026-64539", "state": "PUBLISHED", "dateUpdated": "2026-10-21T12:43:26.591Z", "dateReserved": "2026-07-19T15:36:31.795Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-07-27T20:10:33.363Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/bluetooth/eir.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "0f0b6232af56441d0a2dcb173cc4f8d8aab39014", "status": "affected", "version": "b44133ff03be30b55f23036e62f403a3f7784fce", "versionType": "git"}, {"lessThan": "9174992ee1045c9c96e53eecda64f49dd7e8fbba", "status": "affected", "version": "b44133ff03be30b55f23036e62f403a3f7784fce", "versionType": "git"}, {"lessThan": "09301f1fdf2aef8cce34d0c4650c30e7edb1ced9", "status": "affected", "version": "b44133ff03be30b55f23036e62f403a3f7784fce", "versionType": "git"}, {"lessThan": "f1b4df9c260c51726da2e86e19322825fddeefd0", "status": "affected", "version": "b44133ff03be30b55f23036e62f403a3f7784fce", "versionType": "git"}, {"lessThan": "57077eeb586c42f124bc09e018449362223067b3", "status": "affected", "version": "b44133ff03be30b55f23036e62f403a3f7784fce", "versionType": "git"}, {"lessThan": "6f5fb689fdf80bdd143f22a502f9eb1f3c85e286", "status": "affected", "version": "b44133ff03be30b55f23036e62f403a3f7784fce", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/bluetooth/eir.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.1"}, {"lessThan": "4.1", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.178", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.97", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.40", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "746E9362-BD2A-4210-8EC5-4971697C2B5D", "versionEndExcluding": "6.1.178", "versionStartIncluding": "4.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "F4346054-F978-40BD-BC1C-32AA73CA50DD", "versionEndExcluding": "6.6.160", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "05880CF6-5AD2-44E9-853A-6CE8318E76A5", "versionEndExcluding": "6.12.97", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "67D87928-1419-4529-9201-42C059678CB4", "versionEndExcluding": "6.18.40", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "FE149C35-43CC-473B-86E3-978E6A9CBC55", "versionEndExcluding": "7.1.5", "versionStartIncluding": "6.19", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: eir: Fix stack OOB write when prepending the Flags AD\n\neir_create_adv_data() builds the advertising data into a fixed-size\nbuffer (\"size\", 31 for the legacy path). It may prepend a 3-byte \"Flags\"\nAD structure (LE_AD_NO_BREDR on an LE-only controller) and then copies\nthe per-instance data without checking that it still fits:\n\n\tmemcpy(ptr, adv->adv_data, adv->adv_data_len);\n\ntlv_data_max_len() only reserves those 3 bytes when the user-supplied\nflags carry a managed-flags bit, so an instance added with flags == 0 is\naccepted with adv_data_len up to the full buffer. At advertise time the\nflags are still prepended, and the memcpy() writes 3 + adv_data_len\nbytes into the size-byte buffer:\n\n BUG: KASAN: stack-out-of-bounds in eir_create_adv_data (net/bluetooth/eir.c:301)\n Write of size 31 at addr ffff88800a547bdc by task kworker/u9:0/65\n Workqueue: hci0 hci_cmd_sync_work\n __asan_memcpy (mm/kasan/shadow.c:106)\n eir_create_adv_data (net/bluetooth/eir.c:301)\n hci_update_adv_data_sync (net/bluetooth/hci_sync.c:1310)\n hci_schedule_adv_instance_sync (net/bluetooth/hci_sync.c:1817)\n hci_cmd_sync_work (net/bluetooth/hci_sync.c:332)\n This frame has 1 object:\n [32, 64) 'cp'\n\nThe \"Flags\" structure is added by the kernel, not requested by\nuserspace, so only prepend it when it fits together with the instance\nadvertising data; when there is no room for both, drop the flags rather\nthan the user-provided data.\n\nReachable by a local user with CAP_NET_ADMIN owning an LE-only\ncontroller on the legacy advertising path."}], "id": "CVE-2026-64539", "lastModified": "2026-11-13T18:27:23.893", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-64539", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T15:42:00.875042Z", "version": "2.0.3"}}]}, "published": "2026-07-27T21:17:06.277", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/09301f1fdf2aef8cce34d0c4650c30e7edb1ced9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0f0b6232af56441d0a2dcb173cc4f8d8aab39014"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/57077eeb586c42f124bc09e018449362223067b3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/6f5fb689fdf80bdd143f22a502f9eb1f3c85e286"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/9174992ee1045c9c96e53eecda64f49dd7e8fbba"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f1b4df9c260c51726da2e86e19322825fddeefd0"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-121"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: Bluetooth: eir: Fix stack OOB write when prepending the Flags AD", "id": "2507790", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507790"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "details": ["No description is available for this CVE."], "name": "CVE-2026-64539", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-07-27T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-64539\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-64539\nhttps://lore.kernel.org/linux-cve-announce/2026072735-CVE-2026-64539-4b67@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b44133ff03be30b55f23036e62f403a3f7784fce,0f0b6232af56441d0a2dcb173cc4f8d8aab39014)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b44133ff03be30b55f23036e62f403a3f7784fce,09301f1fdf2aef8cce34d0c4650c30e7edb1ced9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b44133ff03be30b55f23036e62f403a3f7784fce,f1b4df9c260c51726da2e86e19322825fddeefd0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b44133ff03be30b55f23036e62f403a3f7784fce,57077eeb586c42f124bc09e018449362223067b3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b44133ff03be30b55f23036e62f403a3f7784fce,6f5fb689fdf80bdd143f22a502f9eb1f3c85e286)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.1"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,4.1)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.178,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.97,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.40,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.5,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-07-28T02:15:17.609711+00:00", "updated": "2026-10-20T04:30:09.466401+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-121"]}