Skip to main content

Linux Kernel CVE-2026-64407

| EUVDEUVD-2026-48951 HIGH
Out-of-bounds Read (CWE-125)
2026-07-25 Linux GHSA-vpwp-65cp-hgqm
Information Disclosure Linux Red Hat Suse
7.1
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.1 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
vuln.today AI
6.3 MEDIUM

AC raised to H because exploitation requires a malicious or compromised Bluetooth controller, not just local user access.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High

Lifecycle Timeline

6
Metadata Corrected
Sep 04, 2026 - 16:40 vuln.today
tag: Buffer Overflow removed
Analysis Generated
Sep 04, 2026 - 15:59 vuln.today
CVSS changed
Sep 04, 2026 - 15:37 NVD
7.1 (HIGH)
Patch available
Jul 25, 2026 - 11:18 EUVD
CVE Published
Jul 25, 2026 - 08:50 nvd
HIGH 7.1
CVE Published
Jul 25, 2026 - 08:50 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3()

During the v3 firmware download the controller sends a v3_data_req with a 32 bit offset and a 16 bit len. nxp_recv_fw_req_v3() checks only the lower bound of the offset and then sends firmware from that offset.

nxpdev->fw_dnld_v3_offset = offset - nxpdev->fw_v3_offset_correction; serdev_device_write_buf(nxpdev->serdev, nxpdev->fw->data + nxpdev->fw_dnld_v3_offset, len);

Nothing checks that fw_dnld_v3_offset + len stays within nxpdev->fw->size, so a controller that asks for an offset or length past the firmware image makes the driver read past the end of nxpdev->fw->data and send that memory back over UART.

nxp_recv_fw_req_v1() already bounds the same write. Add the equivalent check to the v3 path, reject the request when it falls outside the firmware image, and zero len on the error path so the fw_v3_prev_sent bookkeeping at free_skb stays consistent.

AnalysisAI

Out-of-bounds memory read in the Linux kernel's btnxpuart Bluetooth driver exposes kernel memory to a malicious or compromised NXP Bluetooth UART controller. The vulnerability exists in nxp_recv_fw_req_v3(), which handles firmware download requests during v3 controller initialization: when the controller supplies a crafted 32-bit offset or 16-bit length value that pushes past the end of the firmware image, the driver reads arbitrary kernel memory and transmits it back to the controller over UART. The parallel v1 path (nxp_recv_fw_req_v1()) already contained the equivalent bounds check; the v3 path lacked it. No active exploitation is confirmed (not in CISA KEV) and EPSS is 0.21% (11th percentile), consistent with the narrow local/hardware attack surface.

Technical ContextAI

The btnxpuart driver (drivers/bluetooth/btnxpuart.c) handles firmware download for NXP Bluetooth UART controllers. During v3 firmware download, the controller sends a v3_data_req message containing a uint32 offset and uint16 length. nxp_recv_fw_req_v3() computes fw_dnld_v3_offset = offset - fw_v3_offset_correction and then calls serdev_device_write_buf() passing fw->data + fw_dnld_v3_offset with length len. The function validated only that offset >= fw_v3_offset_correction (lower-bound check) but never verified that fw_dnld_v3_offset + len <= fw->size (upper-bound check). This CWE-125 (Out-of-Bounds Read) violation means a controller requesting data beyond the firmware image boundary causes the kernel to read and transmit whatever kernel memory follows the firmware blob, potentially leaking sensitive in-memory data. The affected CPE is cpe:2.3:a:linux:linux covering all kernel versions containing commit 689ca16e523278470c38832a3010645a78c544d8 (which introduced the v3 download path) through the respective fix commits per stable branch.

RemediationAI

Apply the vendor-released kernel patches corresponding to the running stable branch: upgrade to Linux 6.6.145 or later for the 6.6.x series, 6.12.96 or later for 6.12.x, 6.18.39 or later for 6.18.x, or 7.1.4 / 7.2-rc3 for the mainline series. Patch commits are referenced at git.kernel.org/stable/c/21e60eb4d95854196e7c0e77383f35e7ac95df61 and related links. Distribution-specific kernels (Debian, Ubuntu, RHEL, etc.) should receive backports through their respective security channels. As a compensating control on systems where patching is not immediately possible, disabling or blacklisting the btnxpuart kernel module (modprobe -r btnxpuart; echo 'blacklist btnxpuart' >> /etc/modprobe.d/blacklist.conf) will prevent the driver from loading, at the cost of disabling NXP Bluetooth UART functionality entirely. Physical access controls to prevent controller substitution are also relevant mitigations for high-assurance embedded deployments.

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2025-5777 CRITICAL POC
9.3
CVE-2016-1646 HIGH POC
8.8
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Real Time 15 SP7 SUSE Real Time Module 15 SP7 Fixed
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected

Share

CVE-2026-64407 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy