CVE-2026-64126: Linux Kernel Privilege Escalation Flaw

CVE-2026-64126 Overview

CVE-2026-64126 is an out-of-bounds read vulnerability in the Linux kernel's Bluetooth Management (MGMT) interface. The flaw resides in the handler for MGMT_OP_ADD_EXT_ADV_DATA, a variable-length command that fails to validate whether cp->adv_data_len and cp->scan_rsp_len fit within the actual command payload. A local attacker with CAP_NET_ADMIN in the initial user namespace can trigger an 8-byte slab-out-of-bounds read, confirmed by KASAN. Adjacent kernel memory can be copied into the advertising instance and read back through MGMT_OP_GET_ADV_INSTANCE, leading to information disclosure.

Critical Impact
Local attackers with CAP_NET_ADMIN can read adjacent slab memory through the Bluetooth MGMT interface, exposing sensitive kernel data.

Affected Products

Linux kernel (Bluetooth MGMT subsystem)
Stable branches referenced in upstream fix commits
Distributions shipping vulnerable kernels prior to backported patches

Discovery Timeline

2026-07-19 - CVE-2026-64126 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-64126

Vulnerability Analysis

The defect sits in the add_ext_adv_data() handler inside the Bluetooth MGMT layer. MGMT_OP_ADD_EXT_ADV_DATA is registered as a variable-length command with MGMT_ADD_EXT_ADV_DATA_SIZE as the fixed header. The handler trusts the caller-supplied cp->adv_data_len and cp->scan_rsp_len fields when validating and copying cp->data, without confirming those bytes actually belong to the command buffer.

A short command that declares large adv_data_len or scan_rsp_len values causes the handler to advance beyond the received payload. tlv_data_is_valid() then reads out-of-bounds slab memory. If those bytes are addressable, the same memory is stored inside the advertising instance as scan response data.

Root Cause

The root cause is missing length validation. The command handler does not verify that the total command length equals MGMT_ADD_EXT_ADV_DATA_SIZE + adv_data_len + scan_rsp_len before dereferencing cp->data. This is a classic input validation error leading to an out-of-bounds read [CWE-125].

Attack Vector

Exploitation requires local access and CAP_NET_ADMIN in the initial user namespace. An attacker crafts a truncated MGMT_OP_ADD_EXT_ADV_DATA command declaring inflated advertising or scan response lengths. The kernel then copies adjacent slab bytes into the advertising instance. The attacker retrieves the leaked data by issuing MGMT_OP_GET_ADV_INSTANCE, extracting kernel memory contents from the returned scan response.

No verified public exploit code is available. See the upstream fix commits, such as kernel commit a143ce77, for the corrective patch that rejects malformed commands before parsing.

Detection Methods for CVE-2026-64126

Indicators of Compromise

KASAN reports flagging slab-out-of-bounds reads in tlv_data_is_valid() or add_ext_adv_data().
Unexpected invocations of MGMT_OP_ADD_EXT_ADV_DATA from non-Bluetooth-management processes.
Anomalous sequences of MGMT_OP_ADD_EXT_ADV_DATA immediately followed by MGMT_OP_GET_ADV_INSTANCE from the same process.

Detection Strategies

Enable KASAN on test and staging kernels to surface the out-of-bounds read at runtime.
Audit processes holding CAP_NET_ADMIN and correlate their Bluetooth MGMT socket activity.
Deploy auditd rules on AF_BLUETOOTH socket operations to capture MGMT command usage.

Monitoring Recommendations

Forward kernel logs and audit records to a centralized SIEM for correlation with process ancestry.
Track privilege capability grants over time, alerting on new processes acquiring CAP_NET_ADMIN.
Baseline legitimate Bluetooth stack activity and alert on deviations, especially on servers where Bluetooth is not expected.

How to Mitigate CVE-2026-64126

Immediate Actions Required

Apply the upstream Linux kernel patches referenced by the stable commits and reboot affected hosts.
Restrict CAP_NET_ADMIN to trusted service accounts and remove it from unprivileged workloads and containers.
Disable the Bluetooth subsystem on systems that do not require it, particularly servers and virtual machines.

Patch Information

The fix rejects MGMT_OP_ADD_EXT_ADV_DATA commands whose length does not equal the fixed header plus both advertising data lengths before parsing cp->data. Corresponding stable commits include 0bc1a5a6, 0d510439, 14b01b9c, a143ce77, a6c75a3f, d3f7d179, and f1febe93.

Workarounds

Blacklist the bluetooth and btusb kernel modules on systems that do not require Bluetooth functionality.
Enforce seccomp filters that deny socket(AF_BLUETOOTH, ...) for workloads that should never issue MGMT commands.
Use user namespace restrictions to prevent unprivileged users from obtaining CAP_NET_ADMIN in nested namespaces.

bash

# Configuration example
# Disable Bluetooth modules until the kernel patch is applied
echo 'install bluetooth /bin/true' | sudo tee /etc/modprobe.d/disable-bluetooth.conf
echo 'install btusb /bin/true'      | sudo tee -a /etc/modprobe.d/disable-bluetooth.conf
sudo systemctl disable --now bluetooth.service
sudo rmmod btusb bluetooth 2>/dev/null || true