CVE-2026-64539: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-64539 Overview

CVE-2026-64539 is a stack out-of-bounds write vulnerability in the Linux kernel's Bluetooth subsystem. The flaw resides in eir_create_adv_data() within net/bluetooth/eir.c, which constructs Bluetooth Low Energy (LE) advertising data in a fixed 31-byte buffer. When the kernel prepends a 3-byte Flags Advertising Data (AD) structure on an LE-only controller, it fails to verify that user-supplied advertising data still fits. A local attacker with CAP_NET_ADMIN privileges controlling an LE-only Bluetooth controller can trigger a 3-byte overflow past the end of a kernel stack buffer.

Critical Impact
Local attackers with CAP_NET_ADMIN can trigger a kernel stack out-of-bounds write, potentially leading to memory corruption, privilege escalation, or denial of service.

Affected Products

Linux kernel Bluetooth subsystem (net/bluetooth/eir.c)
Systems using legacy Bluetooth Low Energy advertising path
LE-only Bluetooth controllers on affected kernel versions

Discovery Timeline

2026-07-27 - CVE-2026-64539 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-64539

Vulnerability Analysis

The vulnerability is a stack-based out-of-bounds write [CWE-121] in the Linux kernel Bluetooth extended inquiry response (EIR) code path. The function eir_create_adv_data() builds advertising data into a fixed-size stack buffer of 31 bytes for the legacy advertising path.

The kernel may prepend a 3-byte Flags AD structure (LE_AD_NO_BREDR) when running on an LE-only controller. It then copies the per-instance advertising data via memcpy(ptr, adv->adv_data, adv->adv_data_len) without verifying that the combined length fits within the buffer.

The helper tlv_data_max_len() only reserves the 3 bytes for the Flags structure when the user-supplied flags carry a managed-flags bit. An advertising instance added with flags == 0 is therefore accepted with adv_data_len filling the full buffer. At advertising time the Flags are still prepended, producing a write of 3 + adv_data_len bytes into a 31-byte destination.

Kernel Address Sanitizer (KASAN) reports the condition as a stack-out-of-bounds write of 31 bytes triggered from hci_cmd_sync_work via hci_update_adv_data_sync().

Root Cause

The root cause is inconsistent length accounting between tlv_data_max_len() and eir_create_adv_data(). The validator only reserves space for the Flags AD when managed-flags bits are set, but the builder always prepends those Flags on LE-only controllers. This mismatch allows user-controlled adv_data_len values to exceed the buffer capacity by 3 bytes.

Attack Vector

The vulnerability is reachable by a local user holding CAP_NET_ADMIN on an LE-only Bluetooth controller through the legacy advertising path. The attacker registers an advertising instance with flags == 0 and maximum adv_data_len. When the kernel schedules the advertising update, the Flags AD is prepended and the subsequent memcpy() writes past the stack frame boundary. This is a local privilege escalation vector rather than a remote or network-reachable flaw.

The vulnerability mechanism is documented in the upstream commits referenced by the Kernel Git Commit fixing the issue.

Detection Methods for CVE-2026-64539

Indicators of Compromise

Kernel logs showing KASAN stack-out-of-bounds reports referencing eir_create_adv_data or hci_update_adv_data_sync
Unexpected kernel oops or panic messages originating from the hci_cmd_sync_work workqueue
Bluetooth service crashes or hciX interface resets on LE-only controllers

Detection Strategies

Enable KASAN on test kernels to surface the out-of-bounds write during Bluetooth advertising operations
Audit dmesg output for stack corruption signatures involving net/bluetooth/eir.c
Inventory kernels against the fixed commit hashes to identify unpatched hosts

Monitoring Recommendations

Alert on non-root processes acquiring CAP_NET_ADMIN and interacting with /dev/rfkill or Bluetooth management sockets
Monitor Bluetooth Management API (mgmt) calls that register advertising instances with unusually large adv_data_len values
Track kernel crash telemetry and correlate against Bluetooth workqueue activity

How to Mitigate CVE-2026-64539

Immediate Actions Required

Apply the upstream kernel patches referenced in the vendor advisories to all affected Linux systems
On systems that do not require Bluetooth LE advertising, unload the bluetooth kernel module or disable the service
Restrict CAP_NET_ADMIN to trusted administrators and audit existing grants on multi-user hosts

Patch Information

The fix modifies eir_create_adv_data() to prepend the Flags AD only when it fits alongside the instance advertising data. When there is insufficient room for both, the kernel drops the Flags rather than overflowing the buffer with user-controlled data. Patches are available in the following upstream commits: 09301f1fdf2a, 0f0b6232af56, 57077eeb586c, 6f5fb689fdf8, and f1b4df9c260c.

Workarounds

Blacklist the bluetooth and btusb modules on servers and appliances that do not require Bluetooth functionality
Remove CAP_NET_ADMIN from unprivileged users and containers to eliminate the local attack surface
Disable LE advertising on affected controllers using btmgmt until patches are deployed

bash

# Disable and blacklist Bluetooth kernel modules
sudo systemctl disable --now bluetooth.service
echo 'blacklist bluetooth' | sudo tee /etc/modprobe.d/blacklist-bluetooth.conf
echo 'blacklist btusb'     | sudo tee -a /etc/modprobe.d/blacklist-bluetooth.conf
sudo modprobe -r btusb bluetooth