Look up another CVE · open CVE-2026-64539 in the interactive tracker
CVE-2026-64539
Bluetooth: eir: Fix stack OOB write when prepending the Flags AD
Published 2026-07-27 (3 months ago) by the Linux kernel CNA. Subsystem net/bluetooth. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-64539 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixedDLA-4720-1 · 2026-08-05 · text | 6.1.180-1 | Update the kernel and reboot. DLA-4720-1 shipped the fix on 2026-08-05, in 6.1.180-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixedDSA-6405-1 · 2026-07-31 · text | 6.12.100-1 | Update the kernel and reboot. DSA-6405-1 shipped the fix on 2026-07-31, in 6.12.100-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.1.5-1 | Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.5-1 | Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts. |
| Debian 12bookworm · linux-6.12 | fixedDLA-4724-1 · 2026-08-07 · text | 6.12.100-1~deb12u1 | Update the kernel and reboot. DLA-4724-1 shipped the fix on 2026-08-07, in 6.12.100-1~deb12u1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
eir_create_adv_data() builds the advertising data into a fixed-size buffer ("size", 31 for the legacy path). It may prepend a 3-byte "Flags" AD structure (LE_AD_NO_BREDR on an LE-only controller) and then copies the per-instance data without checking that it still fits: memcpy(ptr, adv->adv_data, adv->adv_data_len); tlv_data_max_len() only reserves those 3 bytes when the user-supplied flags carry a managed-flags bit, so an instance added with flags == 0 is accepted with adv_data_len up to the full buffer. At advertise time the flags are still prepended, and the memcpy() writes 3 + adv_data_len bytes into the size-byte buffer: BUG: KASAN: stack-out-of-bounds in eir_create_adv_data (net/bluetooth/eir.c:301) Write of size 31 at addr ffff88800a547bdc by task kworker/u9:0/65 Workqueue: hci0 hci_cmd_sync_work __asan_memcpy (mm/kasan/shadow.c:106) eir_create_adv_data (net/bluetooth/eir.c:301) hci_update_adv_data_sync (net/bluetooth/hci_sync.c:1310) hci_schedule_adv_instance_sync (net/bluetooth/hci_sync.c:1817) hci_cmd_sync_work (net/bluetooth/hci_sync.c:332) This frame has 1 object: [32, 64) 'cp' The "Flags" structure is added by the kernel, not requested by userspace, so only prepend it when it fits together with the instance advertising data; when there is no room for both, drop the flags rather than the user-provided data. Reachable by a local user with CAP_NET_ADMIN owning an LE-only controller on the legacy advertising path.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
net/bluetooth/eir.c
- What this is
- BLUETOOTH SUBSYSTEMMAINTAINERS section matched on net/bluetooth/ · linux-bluetooth@vger.kernel.org · Supported
- Kernel module
- bluetooth
Check it on the machine
grep -w CONFIG_BT /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w bluetoothPrints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian builds this, but not on every flavour. At least one release below builds the code on some of its kernel flavours and not on others, so the answer depends on the architecture and flavour installed.
- bookwormMnot built on amd64/cloud-amd64, arm64/cloud-arm64
- trixie, forky, sidMnot built on amd64/cloud-amd64, arm64/cloud-arm64, s390x/s390x
- bookworm · linux-6.12Mnot built on amd64/cloud-amd64, arm64/cloud-arm64
- M
- a module where it is built at all; some flavours do not build it
- Build switch
- CONFIG_BT
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-07-27 (3 months ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.12%, higher than 1.8% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- net/bluetooth
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 4.1 | 6.1.178 | 0f0b6232af56 |
| 4.1 | 6.12.97 | 09301f1fdf2a |
| 4.1 | 6.18.40 | f1b4df9c260c |
| 4.1 | 7.1.5 | 57077eeb586c |
| 4.1 | 7.2 | 6f5fb689fdf8 |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4724-1 | 2026-08-07 | bookworm 6.12.100-1~deb12u1 | tracker |
| DLA-4723-1 | 2026-08-07 | bullseye 6.1.180-1~deb11u1 | tracker |
| DLA-4720-1 | 2026-08-05 | bookworm 6.1.180-1 | tracker |
| DSA-6405-1 | 2026-07-31 | trixie 6.12.100-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The overflow is driven entirely by locally supplied advertising data written to an AF_BLUETOOTH HCI control socket (MGMT_OP_ADD_ADVERTISING / ADD_EXT_ADV_DATA / MESH_SEND); no remote or adjacent Bluetooth peer can influence the length or contents. Consistent with the same-class CVE-2026-53209 and CVE-2026-64126, this is a local-only trigger.
- AC:LAttack complexity, low
- The attacker fully controls both preconditions — submit an instance with flags==0 and adv_data_len at the maximum, containing no EIR_FLAGS element — and the kernel then deterministically prepends the 3-byte Flags AD on any LE-only controller. No race, no memory-layout luck, no retry needed.
- PR:LPrivileges required, low
- Reaching the mgmt handler requires HCI_SOCK_TRUSTED, granted by CAP_NET_ADMIN, which is a delegated capability routinely held by the Bluetooth stack daemon rather than full system root, and this CNA scores the identical CAP_NET_ADMIN-gated Bluetooth mgmt paths (CVE-2026-64126, CVE-2026-53209, CVE-2026-31511) as PR:L. Choosing the higher-severity option where the privilege boundary is arguable.
- UI:NUser interaction, none
- The attacker issues the mgmt commands itself and the overflow fires from hci_cmd_sync_work when the instance is scheduled for advertising. No victim action of any kind is involved.
- S:UScope, unchanged
- The corruption is confined to the kernel's own stack within the same security authority; there is no VM, IOMMU, or sandbox boundary crossed.
- C:HConfidentiality impact, high
- On the extended-advertising path the inflated length (254 > 251) makes struct_size() copy 3 bytes of adjacent kernel stack past the DEFINE_FLEX pdu into the HCI command skb, which is exposed via the HCI monitor channel and handed to the controller for broadcast, and the stack corruption is generally leverageable for further disclosure.
- I:HIntegrity impact, high
- This is an out-of-bounds write of fully attacker-controlled bytes (the tail of the user-supplied adv_data) past a local stack object, and it additionally leaves hdev->adv_data_len set to a value larger than the data actually stored. An attacker-controlled linear stack overflow is treated as high integrity impact.
- A:HAvailability impact, high
- Overwriting bytes immediately past the stack object corrupts adjacent frame state and, with CONFIG_STACKPROTECTOR, will trip __stack_chk_fail leading to a kernel panic; the reported KASAN stack-out-of-bounds confirms real memory corruption in hci_cmd_sync_work.