Local Stack Out-of-Bounds Write Vulnerability in Linux Kernel Bluetooth

CVE-2026-64539

What is CVE-2026-64539?

A vulnerability in the Linux kernel's Bluetooth implementation allows a local user with CAP_NET_ADMIN privileges to trigger a stack out-of-bounds write. The issue arises during the creation of advertising data where a fixed-size buffer does not adequately account for prepended 'Flags' advertising data. If the flags exceed the buffer's capacity in conjunction with user-defined advertising data, it results in an overflow, potentially leading to unexpected behavior or crashes. To mitigate this, the kernel must ensure that sufficient space is available within the fixed-size buffer before prepending the 'Flags', or alternatively, drop the flags when not feasible.

References