Look up another CVE · open CVE-2026-64403 in the interactive tracker
CVE-2026-64403
Bluetooth: L2CAP: validate option length before reading conf opt value
Published 2026-07-25 (3 months ago) by the Linux kernel CNA. Subsystem net/bluetooth. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-64403 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixedDLA-4720-1 · 2026-08-05 · text | 6.1.180-1 | Update the kernel and reboot. DLA-4720-1 shipped the fix on 2026-08-05, in 6.1.180-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixed | 6.12.96-1 | Update the kernel and reboot. Fixed in 6.12.96-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.1.4-1 | Update the kernel and reboot. Fixed in 7.1.4-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.4-1 | Update the kernel and reboot. Fixed in 7.1.4-1. A running kernel keeps the old code until the machine restarts. |
| Debian 12bookworm · linux-6.12 | fixedDLA-4724-1 · 2026-08-07 · text | 6.12.100-1~deb12u1 | Update the kernel and reboot. DLA-4724-1 shipped the fix on 2026-08-07, in 6.12.100-1~deb12u1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
l2cap_get_conf_opt() derives the option length from the attacker-controlled opt->len field and immediately dereferences opt->val (as u8, get_unaligned_le16() or get_unaligned_le32(), or a raw pointer for the default case) before any caller has confirmed that opt->len bytes are present in the buffer. The callers (l2cap_parse_conf_req(), l2cap_parse_conf_rsp() and l2cap_conf_rfc_get()) only detect a malformed option afterwards, once the running length has gone negative, by which point the out-of-bounds read has already executed. An existing post-hoc length check keeps the garbage value from being consumed, so this is not a data leak in the current control flow. It is still a validate-after-use ordering bug: up to 4 bytes are read past the end of the buffer before it is known to contain them, and it is fragile to future changes in the callers. Fix it at the source. Pass the end of the buffer into l2cap_get_conf_opt() and refuse to touch opt->val unless the full option (header + value) fits. Each caller computes an end pointer once before the loop and checks the return value directly instead of inferring the error from a negative length.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
net/bluetooth/l2cap_core.c
- What this is
- BLUETOOTH SUBSYSTEMMAINTAINERS section matched on net/bluetooth/ · linux-bluetooth@vger.kernel.org · Supported
- Kernel module
- bluetooth
Check it on the machine
grep -w CONFIG_BT /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w bluetoothPrints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian builds this, but not on every flavour. At least one release below builds the code on some of its kernel flavours and not on others, so the answer depends on the architecture and flavour installed.
- bookwormMnot built on amd64/cloud-amd64, arm64/cloud-arm64
- trixie, forky, sidMnot built on amd64/cloud-amd64, arm64/cloud-arm64, s390x/s390x
- bookworm · linux-6.12Mnot built on amd64/cloud-amd64, arm64/cloud-arm64
- M
- a module where it is built at all; some flavours do not build it
- Build switch
- CONFIG_BT
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-07-25 (3 months ago)source
- CVSS
- 7.1 high
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:Hsource recompute it - Attack vector
- adjacent network (AV:A)source
- EPSS
- 0.27%, higher than 17.2% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- net/bluetooth
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 5.1 | 5.10.261 | cca81b4bc672 |
| 5.1 | 5.15.212 | f70d4aa88068 |
| 5.1 | 6.1.178 | 7d871e969b94 |
| 5.1 | 6.6.145 | 98d93c226bdf |
| 5.1 | 6.12.96 | 996d3da39899 |
| 5.1 | 6.18.39 | 73abbaf91aa3 |
| 5.1 | 7.1.4 | 6b47bdaacfd0 |
| 5.1 | 7.2 | 687617555ced |
| 3.16.66 | 0 | 0 |
| 3.18.138 | 0 | 0 |
| 4.4.178 | 0 | 0 |
| 4.9.167 | 0 | 0 |
| 4.14.110 | 0 | 0 |
| 4.19.33 | 0 | 0 |
| 5.0.6 | 0 | 0 |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4724-1 | 2026-08-07 | bookworm 6.12.100-1~deb12u1 | tracker |
| DLA-4723-1 | 2026-08-07 | bullseye 6.1.180-1~deb11u1 | tracker |
| DLA-4720-1 | 2026-08-05 | bookworm 6.1.180-1 | tracker |
| DLA-4717-1 | 2026-08-05 | bullseye 5.10.262-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:AAttack vector, adjacent network
- The vulnerable parser processes attacker-controlled BR/EDR L2CAP configuration packets received from a Bluetooth peer within radio range.
- AC:LAttack complexity, low
- A malformed option with a declared length exceeding the remaining buffer directly triggers the invalid read; no race or condition outside the attacker's control is required.
- PR:NPrivileges required, none
- An unauthenticated Bluetooth peer can establish an SDP L2CAP channel, for which Linux bypasses the normal link-security check, and then submit configuration packets.
- UI:NUser interaction, none
- Once the Bluetooth interface is connectable with an applicable listening service, the peer can establish the channel and send the malformed option without victim action.
- S:UScope, unchanged
- The vulnerable Bluetooth parser and the resulting kernel impact are within the same host kernel security authority, without crossing a VM, sandbox, or IOMMU boundary.
- C:LConfidentiality impact, low
- The invalid read is strictly bounded to at most four adjacent bytes. Although the post-hoc check prevents the value from being consumed in the current protocol flow, limited confidentiality impact is the higher defensible choice.
- I:NIntegrity impact, none
- The flaw performs only an out-of-bounds read, and the invalid value is discarded before option-specific processing; there is no memory write or control-flow corruption primitive.
- A:HAvailability impact, high
- The invalid kernel read can produce an oops or panic when it reaches an inaccessible or hardened boundary, and an unauthenticated adjacent peer can repeatedly send malformed configuration options.