---
id: CVE-2026-64126
title: 'Bluetooth: MGMT: validate Add Extended Advertising Data length'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  Bluetooth: MGMT: validate Add Extended Advertising Data length

  MGMT_OP_ADD_EXT_ADV_DATA is registered as a variable-length command,
  with MGMT_ADD_EXT_ADV_DATA_SIZE as …
severity: high
cvss: 7.3
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 12410572833a283ce92fcf9679ca8a2f372097ee <
    0d5104390b445e7bd664ad583837e4c04d892c9d
  - >-
    Linux >= 12410572833a283ce92fcf9679ca8a2f372097ee <
    14b01b9cba04e6ce82825f68fc4c4322fa4ffa43
  - >-
    Linux >= 12410572833a283ce92fcf9679ca8a2f372097ee <
    a143ce77a5292f2c9285137433d879ce71d190a7
  - >-
    Linux >= 12410572833a283ce92fcf9679ca8a2f372097ee <
    a6c75a3fad226ccbd8ef9110dee87c92c299f2ab
  - >-
    Linux >= 12410572833a283ce92fcf9679ca8a2f372097ee <
    f1febe93ef075314615f970a87681d9ab86691d1
  - >-
    Linux >= 12410572833a283ce92fcf9679ca8a2f372097ee <
    0bc1a5a69f541859293d79db72bd7854ac48df51
  - >-
    Linux >= 12410572833a283ce92fcf9679ca8a2f372097ee <
    d3f7d17960ed50df3a6709c5158caff989c8c905
  - Linux 5.11
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:36:50.332780Z'
published: '2026-07-19'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:42:24.427Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-64126'
references:
  - url: 'https://git.kernel.org/stable/c/0d5104390b445e7bd664ad583837e4c04d892c9d'
  - url: 'https://git.kernel.org/stable/c/14b01b9cba04e6ce82825f68fc4c4322fa4ffa43'
  - url: 'https://git.kernel.org/stable/c/a143ce77a5292f2c9285137433d879ce71d190a7'
  - url: 'https://git.kernel.org/stable/c/a6c75a3fad226ccbd8ef9110dee87c92c299f2ab'
  - url: 'https://git.kernel.org/stable/c/f1febe93ef075314615f970a87681d9ab86691d1'
  - url: 'https://git.kernel.org/stable/c/0bc1a5a69f541859293d79db72bd7854ac48df51'
  - url: 'https://git.kernel.org/stable/c/d3f7d17960ed50df3a6709c5158caff989c8c905'
tags:
  - cve.org
epss: 0.00135
epssPercentile: 0.02644
ingestedAt: '2026-10-16T17:24:46.807Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: MGMT: validate Add Extended Advertising Data length

MGMT_OP_ADD_EXT_ADV_DATA is registered as a variable-length command,
with MGMT_ADD_EXT_ADV_DATA_SIZE as the fixed header size.  The handler
then uses cp->adv_data_len and cp->scan_rsp_len to validate and copy
cp->data, but it never checks that those bytes are part of the mgmt
command payload.

A short command can therefore make add_ext_adv_data() pass an
out-of-bounds pointer into tlv_data_is_valid().  If the bytes beyond
the command buffer are addressable, they can also be copied into the
advertising instance as scan response data, where the caller can read
them back via MGMT_OP_GET_ADV_INSTANCE.  The trigger requires
CAP_NET_ADMIN in the initial user namespace; KASAN reports an 8-byte
slab-out-of-bounds read.

Reject commands whose length does not match the fixed header plus both
advertising data lengths before parsing cp->data.

## Affected

- `Linux >= 12410572833a283ce92fcf9679ca8a2f372097ee < 0d5104390b445e7bd664ad583837e4c04d892c9d`
- `Linux >= 12410572833a283ce92fcf9679ca8a2f372097ee < 14b01b9cba04e6ce82825f68fc4c4322fa4ffa43`
- `Linux >= 12410572833a283ce92fcf9679ca8a2f372097ee < a143ce77a5292f2c9285137433d879ce71d190a7`
- `Linux >= 12410572833a283ce92fcf9679ca8a2f372097ee < a6c75a3fad226ccbd8ef9110dee87c92c299f2ab`
- `Linux >= 12410572833a283ce92fcf9679ca8a2f372097ee < f1febe93ef075314615f970a87681d9ab86691d1`
- `Linux >= 12410572833a283ce92fcf9679ca8a2f372097ee < 0bc1a5a69f541859293d79db72bd7854ac48df51`
- `Linux >= 12410572833a283ce92fcf9679ca8a2f372097ee < d3f7d17960ed50df3a6709c5158caff989c8c905`
- `Linux 5.11`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.