CVE-2026-64549: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-64549 Overview

CVE-2026-64549 is an out-of-bounds read vulnerability in the Linux kernel Bluetooth bpa10x driver. The flaw resides in the bpa10x_setup() function, which sends vendor command 0xfc0e and passes the response buffer to bt_dev_info() and hci_set_fw_info() as a %s string without validating the response length or NUL-termination. A device returning a one-byte status-only response or an unterminated payload causes the format string routine to read adjacent slab memory until it encounters a NUL byte. The leaked bytes are written into the kernel log and the firmware-info debugfs file, resulting in kernel memory disclosure.

Critical Impact
Adjacent kernel slab memory can be disclosed through kernel logs and debugfs when a malformed or malicious Bluetooth device is attached, aiding kernel address leaks and further exploitation.

Affected Products

Linux kernel Bluetooth subsystem — bpa10x USB Bluetooth driver
Linux kernel branches receiving the referenced stable backports
Systems supporting Digianswer BPA 10x USB Bluetooth adapters

Discovery Timeline

2026-07-27 - CVE-2026-64549 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-64549

Vulnerability Analysis

The bpa10x_setup() function issues a vendor-specific HCI command (0xfc0e) to retrieve the adapter revision string. The response arrives in an sk_buff, and the driver treats skb->data + 1 as a NUL-terminated C string when passing it to two logging routines:

bt_dev_info(hdev, "%s", (char *)(skb->data + 1));
hci_set_fw_info(hdev, "%s", skb->data + 1);

Neither call bounds the string against skb->len. When a device returns only the one-byte status field, the pointer skb->data + 1 lands at or past the end of the received payload. The %s conversion in the kernel's vsnprintf() walks memory until it encounters a NUL byte, reading whatever slab data follows the buffer.

Root Cause

The root cause is missing input validation on data received from an untrusted USB peripheral. The driver assumes the vendor command response contains a properly NUL-terminated revision string but does not check whether skb->len is large enough or whether the payload is terminated within the received bytes. This is a classic out-of-bounds read triggered by unbounded string traversal.

Attack Vector

An attacker with the ability to attach a crafted USB Bluetooth device that identifies as a Digianswer BPA 10x adapter can force the driver to return a short or non-terminated response to command 0xfc0e. During driver setup, the out-of-bounds bytes are copied into the kernel ring buffer (dmesg) and into the firmware node under debugfs. An attacker with local read access to those interfaces can then harvest leaked slab contents, which may include kernel pointers useful for defeating KASLR or informing follow-on exploitation. Exploitation requires physical or supply-chain access to the USB port on the target host.

The fix replaces the unbounded %s conversion with a length-bounded %.*s specifier limited to skb->len - 1, ensuring the revision string is never read past the received data while still supporting well-behaved devices.

Detection Methods for CVE-2026-64549

Indicators of Compromise

Unexpected bpa10x driver log entries in dmesg containing non-printable characters, unusual byte sequences, or apparent kernel pointers following the revision string.
Presence of unfamiliar USB Bluetooth devices with vendor/product IDs matching Digianswer BPA 10x on systems where such hardware is not expected.
Reads of /sys/kernel/debug/bluetooth/<hci>/firmware by unprivileged monitoring or reconnaissance tooling.

Detection Strategies

Monitor kernel logs for bpa10x firmware information messages that contain unprintable characters or exceed expected revision-string length.
Audit USB device attachment events using udev or auditd rules to identify Bluetooth adapters bound to the bpa10x driver on production systems.
Track running kernel versions against the fixed commits (1813add7, 4b4008dd, 7a64f39e, a8e169d3, bd56c23f, bfc9e7be, dd068ef0, f80b4afe) to inventory unpatched hosts.

Monitoring Recommendations

Enable auditd rules covering USB insertion and removal events on servers, workstations, and kiosk systems.
Restrict debugfs access to root and confirm mount options do not expose /sys/kernel/debug to unprivileged users or containers.
Forward kernel logs to a centralized logging or SIEM platform and alert on anomalous Bluetooth driver output during boot or hotplug.

How to Mitigate CVE-2026-64549

Immediate Actions Required

Apply the upstream Linux kernel fix that changes the format specifier to %.*s bounded by skb->len - 1 in bpa10x_setup().
Update to a stable kernel release that incorporates one of the referenced fix commits from git.kernel.org.
On systems where the bpa10x driver is not required, blacklist the module to eliminate the attack surface entirely.

Patch Information

The upstream patch modifies bpa10x_setup() to print the revision string with a length-bounded conversion %.*s limited to skb->len - 1 instead of an unbounded %s. The fix has been backported across multiple stable branches. Refer to the following kernel commits:

Workarounds

Blacklist the bpa10x kernel module on systems that do not use Digianswer BPA 10x hardware.
Restrict physical USB access on servers and sensitive endpoints, and enforce USB port control policy for portable devices.
Restrict debugfs visibility so unprivileged users cannot read the Bluetooth firmware node containing leaked bytes.

bash

# Blacklist the vulnerable driver until the kernel is patched
echo "blacklist bpa10x" | sudo tee /etc/modprobe.d/blacklist-bpa10x.conf
sudo modprobe -r bpa10x 2>/dev/null || true

# Restrict debugfs to root only
sudo mount -o remount,mode=700 /sys/kernel/debug