CVE-2026-64407: Linux Kernel Information Disclosure Flaw

CVE-2026-64407 Overview

CVE-2026-64407 is an out-of-bounds read vulnerability in the Linux kernel's Bluetooth btnxpuart driver. The flaw resides in the nxp_recv_fw_req_v3() function, which handles v3 firmware download requests from NXP Bluetooth controllers. During firmware transfer, the controller sends a v3_data_req containing a 32-bit offset and 16-bit length. The driver validates only the lower bound of the offset, allowing a malicious or malfunctioning controller to request data beyond the firmware image. The driver then reads past the end of nxpdev->fw->data and transmits kernel memory contents back over the UART interface.

Critical Impact
A controller-supplied offset and length can trigger an out-of-bounds read of kernel memory adjacent to the firmware buffer, with the leaked bytes transmitted back over UART to the requesting Bluetooth controller.

Affected Products

Linux kernel Bluetooth subsystem (drivers/bluetooth/btnxpuart.c)
Systems using NXP Bluetooth controllers over UART with v3 firmware download protocol
Kernel branches referenced in the upstream stable commits 21e60eb, 2a68a77, 4410887, 49bcb39, and badff6c3

Discovery Timeline

2026-07-25 - CVE-2026-64407 published to NVD
2026-07-25 - Last updated in NVD database

Technical Details for CVE-2026-64407

Vulnerability Analysis

The btnxpuart driver implements NXP Bluetooth controller firmware loading over a serial device (serdev) UART transport. When the controller enters v3 firmware download mode, it issues v3_data_req packets that specify which portion of the firmware image to send next. The receive handler nxp_recv_fw_req_v3() computes an offset into the firmware buffer, then invokes serdev_device_write_buf() to push len bytes back to the controller starting at that offset.

The driver enforces a lower bound on the offset but never validates that fw_dnld_v3_offset + len remains within nxpdev->fw->size. A controller that requests an offset near the end of the image, or a length that overruns the buffer, causes the driver to read adjacent kernel memory. Those bytes are then transmitted over UART to the controller, resulting in kernel memory disclosure to an attached Bluetooth device.

Root Cause

The root cause is missing upper-bound validation on the combined offset and length values supplied by an untrusted controller. The v1 handler nxp_recv_fw_req_v1() already performs this bounds check, but the v3 code path was implemented without the equivalent guard. This is a classic out-of-bounds read caused by improper input validation of externally supplied buffer indices.

Attack Vector

Exploitation requires a controller that speaks the NXP v3 firmware download protocol and can be induced or programmed to send crafted v3_data_req messages. This is a local attack surface against the Linux Bluetooth stack, exposed at the UART boundary between the host and the Bluetooth controller. An attacker with physical access, a compromised or malicious Bluetooth chip, or the ability to substitute firmware download responses can trigger disclosure of kernel memory sitting after the firmware image. See the upstream commits referenced below for the corrected bounds check.

Detection Methods for CVE-2026-64407

Indicators of Compromise

Kernel log entries from the btnxpuart driver indicating rejected v3 firmware requests after the patch is applied, especially repeated malformed offset or length values.
Unexpected Bluetooth controller behavior during firmware download, such as repeated requests for offsets outside expected ranges.
UART traffic showing v3_data_req messages with offsets or lengths that would exceed the loaded firmware image size.

Detection Strategies

Audit running kernel versions across Linux endpoints and compare against the fixed commits 21e60eb4, 2a68a773, 44108879, 49bcb39e, and badff6c3.
Monitor dmesg and journalctl -k output for anomalous messages from the btnxpuart module during Bluetooth initialization.
Inventory devices that use NXP Bluetooth silicon over UART and prioritize them for kernel patching.

Monitoring Recommendations

Track kernel package updates in configuration management to confirm patched builds are deployed across the fleet.
Alert on module load events for btnxpuart on systems where Bluetooth is not expected to be active.
Correlate physical access events with Bluetooth initialization telemetry on high-value endpoints and embedded devices.

How to Mitigate CVE-2026-64407

Immediate Actions Required

Apply the upstream Linux kernel patches that add the missing bounds check to nxp_recv_fw_req_v3().
Rebuild or update kernel packages from distribution vendors as fixed builds become available.
On systems that do not require NXP Bluetooth over UART, blacklist the btnxpuart module until a patched kernel is installed.

Patch Information

The fix rejects any v3_data_req whose offset plus length falls outside nxpdev->fw->size and zeroes len on the error path so that fw_v3_prev_sent bookkeeping in the free-skb handler stays consistent. The corrected code is available in the following upstream commits: Linux Kernel Commit 21e60eb, Linux Kernel Commit 2a68a77, Linux Kernel Commit 44108879, Linux Kernel Commit 49bcb39, and Linux Kernel Commit badff6c3.

Workarounds

Disable loading of the btnxpuart kernel module on systems that do not use NXP Bluetooth controllers by adding it to /etc/modprobe.d/blacklist.conf.
Restrict physical access to devices that use vulnerable Bluetooth controllers to reduce the risk of malicious controller substitution.
Where feasible, disable Bluetooth entirely on affected systems until the patched kernel is deployed.

bash

# Blacklist the vulnerable driver until a patched kernel is installed
echo "blacklist btnxpuart" | sudo tee /etc/modprobe.d/blacklist-btnxpuart.conf
sudo rmmod btnxpuart 2>/dev/null || true
sudo update-initramfs -u