Skip to main content

Linux Kernel EUVDEUVD-2026-39206

| CVE-2026-53255 HIGH
Out-of-bounds Read (CWE-125)
2026-06-25 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-hxxh-4jr7-w99w
Buffer Overflow Information Disclosure Linux Red Hat Suse
7.1
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.1 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
vuln.today AI
4.4 MEDIUM

Local HCI MGMT access needs Bluetooth privileges (PR:L, AV:L); a one-byte OOB read leaks minimal data (C:L) and only crashes on hardened/KASAN kernels (A:L), with no integrity impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 08, 2026 - 17:03 vuln.today
CVSS changed
Jul 08, 2026 - 16:52 NVD
7.1 (HIGH)
Patch available
Jun 25, 2026 - 10:32 EUVD
CVE Published
Jun 25, 2026 - 09:16 nvd
HIGH 7.1
CVE Published
Jun 25, 2026 - 09:16 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: MGMT: validate advertising TLV before type checks

tlv_data_is_valid() reads each advertising data field length from data[i], then inspects data[i + 1] for managed EIR types before checking that the current field still fits inside the supplied buffer.

A malformed field whose length byte is the last byte of the buffer can therefore make the parser read one byte past the advertising data.

KASAN reported the following when a malformed MGMT_OP_ADD_ADVERTISING request reached that path:

BUG: KASAN: vmalloc-out-of-bounds in tlv_data_is_valid() Read of size 1 Call trace: tlv_data_is_valid() add_advertising() hci_mgmt_cmd() hci_sock_sendmsg()

Move the existing element-length check before any type-octet inspection so each non-empty element is proven to contain its type byte before the parser looks at data[i + 1].

AnalysisAI

Out-of-bounds read in the Linux kernel Bluetooth management (MGMT) interface lets a local user with Bluetooth privileges trigger a one-byte read past the advertising-data buffer by submitting a malformed MGMT_OP_ADD_ADVERTISING request. The flaw lives in tlv_data_is_valid(), which inspects the type octet at data[i+1] before confirming the current TLV element fits in the buffer; KASAN flags it as a vmalloc-out-of-bounds read. No public exploit identified at time of analysis and EPSS risk is low (0.17%), consistent with a local-only kernel memory-safety bug rather than a remotely weaponizable one.

Technical ContextAI

The affected code is the Bluetooth HCI Management (MGMT) subsystem used to configure the controller from userspace over an AF_BLUETOOTH/HCI socket. Advertising payloads are Bluetooth Extended Inquiry Response (EIR) style TLV structures, where each element is [length][type][data...]. tlv_data_is_valid() walks this structure reading each element's length from data[i], then examines the managed EIR type at data[i+1] to enforce policy before verifying that data[i+1] and the element body actually lie within the supplied buffer. When the length byte is the final byte of the buffer, dereferencing data[i+1] reads one byte beyond the allocation. This is a classic CWE-125 (Out-of-bounds Read) caused by ordering a content check before the corresponding bounds check. Per the CPE data the affected component is the linux:linux_kernel operating-system package across many maintained branches, including 7.1 release-candidate builds (rc1-rc3) that carried the regression.

RemediationAI

Apply the vendor-released stable kernel updates that reorder the element-length check before the type-octet inspection: upgrade to at least 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.94, 6.18.36, or 7.0.13 depending on your branch, or pull your distribution's kernel package that incorporates the fix for CVE-2026-53255 (fix commits listed at git.kernel.org/stable, e.g. https://git.kernel.org/stable/c/06fcbd79c3c360a50f9be9d370769bbd738d0976). If immediate patching is not possible, reduce exposure by restricting which users and processes hold CAP_NET_ADMIN and can open Bluetooth HCI/MGMT sockets, since the request must originate from a privileged local context; on systems that do not need Bluetooth, unload the bluetooth kernel modules (blacklist bluetooth and btusb) or disable the Bluetooth service, which fully removes the attack surface at the cost of losing Bluetooth functionality. These are compensating controls only - the code-level fix is the reordered bounds check in tlv_data_is_valid().

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2025-5777 CRITICAL POC
9.3
CVE-2016-1646 HIGH POC
8.8
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Image SLES15-SP7-Azure-3P Image SLES15-SP7-Azure-Basic Image SLES15-SP7-Azure-Standard Image SLES15-SP7-HPC-Azure Affected
Image SLES15-SP7-BYOS-Azure Image SLES15-SP7-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-Aliyun Image SLES15-SP7-CHOST-BYOS-Azure Image SLES15-SP7-CHOST-BYOS-EC2 Image SLES15-SP7-CHOST-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-GDC Image SLES15-SP7-CHOST-BYOS-SAP-CCloud Image SLES15-SP7-EC2 Image SLES15-SP7-EC2-ECS-HVM Image SLES15-SP7-GCE Image SLES15-SP7-HPC-BYOS-Azure Image SLES15-SP7-HPC-BYOS-EC2 Image SLES15-SP7-HPC-BYOS-GCE Image SLES15-SP7-Hardened-BYOS-Azure Image SLES15-SP7-Hardened-BYOS-EC2 Image SLES15-SP7-Hardened-BYOS-GCE Image SLES15-SP7-SAPCAL-Azure Image SLES15-SP7-SAPCAL-EC2 Image SLES15-SP7-SAPCAL-GCE Affected
Image SLES15-SP7-SAP-Azure Image SLES15-SP7-SAP-Azure-3P Image SLES15-SP7-SAP-BYOS-Azure Image SLES15-SP7-SAP-BYOS-EC2 Image SLES15-SP7-SAP-BYOS-GCE Image SLES15-SP7-SAP-EC2 Image SLES15-SP7-SAP-GCE Image SLES15-SP7-SAP-Hardened-Azure Image SLES15-SP7-SAP-Hardened-BYOS-Azure Image SLES15-SP7-SAP-Hardened-BYOS-EC2 Image SLES15-SP7-SAP-Hardened-BYOS-GCE Image SLES15-SP7-SAP-Hardened-GCE Affected
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed

Share

EUVD-2026-39206 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy