Bluetooth Vulnerability in Linux Kernel Affecting Qualcomm QCA Devices

CVE-2026-64573

What is CVE-2026-64573?

A vulnerability in the Linux kernel's Bluetooth subsystem could allow a malicious firmware to exploit the TLV parser, leading to buffer overflow due to incorrect handling of tag lengths. Specifically, this flaw occurs in the qca_tlv_check_data() function, where the condition for looping through the firmware data uses a signed integer for length. If the firmware provides a length less than the necessary size, it can cause the subtraction to underflow, resulting in accessing memory outside the allocated buffer. This issue could potentially lead to arbitrary code execution or system crashes, making it imperative for users to update their devices to the latest kernel version that resolves this vulnerability.

References