Bluetooth Vulnerability in Linux Kernel Affects Device Firmware Information Retrieval

CVE-2026-64549

What is CVE-2026-64549?

A vulnerability in the Linux kernel's Bluetooth subsystem allows for an out-of-bounds read when handling responses from devices during the bpa10x_setup() function. Specifically, when the function receives a vendor command response that is one byte long or not properly null-terminated, it attempts to read beyond the allocated buffer, potentially accessing adjacent memory. This flaw could expose sensitive information in kernel logs and the firmware-info debugfs file. To mitigate this, a fix has been implemented to restrict the output to a bounded string size, ensuring that the operation does not fail and maintains compatibility with devices that produce short or improperly terminated responses.

References