CVE-2026-64573: Linux Kernel Bluetooth Buffer Overflow

CVE-2026-64573 Overview

CVE-2026-64573 is a Linux kernel vulnerability in the Qualcomm (qca) Bluetooth driver. The flaw resides in qca_tlv_check_data() within drivers/bluetooth/btqca.c, where an integer underflow in the TLV (Type-Length-Value) parser causes an out-of-bounds read and potential out-of-bounds write on a vmalloc'd firmware buffer. A malformed firmware NVM header with a length field smaller than sizeof(struct tlv_type_nvm) (12 bytes) triggers a wraparound to a large unsigned value, extending the parser loop past the buffer boundary. The issue was detected by KASAN during hci_power_on workqueue execution and has been resolved across multiple stable kernel branches.

Critical Impact
Out-of-bounds memory access in the kernel Bluetooth firmware loader, exploitable through a crafted or corrupted Qualcomm NVM firmware image during device initialization.

Affected Products

Linux kernel Bluetooth subsystem (drivers/bluetooth/btqca.c)
Qualcomm Atheros Bluetooth HCI driver (hci_qca)
Systems using Qualcomm Bluetooth chipsets that load NVM firmware TLV blobs

Discovery Timeline

2026-08-05 - CVE-2026-64573 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-64573

Vulnerability Analysis

The vulnerability is an integer underflow ([CWE-191]) in the TLV_TYPE_NVM branch of qca_tlv_check_data(). The tag-iteration loop uses the bound while (idx < length - sizeof(struct tlv_type_nvm)). Here, length is a signed int sourced from the firmware TLV header, and sizeof(struct tlv_type_nvm) is a size_t equal to 12. Usual arithmetic conversions promote length to size_t before subtraction.

When a firmware image supplies a length value smaller than 12, the subtraction wraps to a very large unsigned quantity. The loop body then reads a 12-byte struct tlv_type_nvm past the end of the short firmware buffer. Downstream EDL_TAG_ID_* handlers can also write past the buffer, corrupting adjacent kernel memory.

Root Cause

The defect is a mixed signed/unsigned arithmetic error. The subtraction length - sizeof(...) should never underflow, but the implicit conversion of a signed integer to size_t removes the compiler's ability to detect a negative result. Any attacker- or corruption-controlled length below the record size produces an effectively unbounded loop bound.

The fix rewrites the condition as idx + sizeof(struct tlv_type_nvm) <= length. Both operands are non-negative, so no underflow can occur, and firmware images with truncated headers now correctly skip the loop.

Attack Vector

Exploitation requires the kernel to load a crafted Qualcomm Bluetooth NVM firmware TLV blob. The vulnerable path is reached during hci_power_on → hci_uart_setup → qca_setup → qca_uart_setup → qca_download_firmware. The KASAN report shows a read of size 2 at a vmalloc boundary in qca_download_firmware.isra.0 at drivers/bluetooth/btqca.c:421. Attack scenarios include a compromised or tampered /lib/firmware NVM file, malicious firmware supply-chain injection, or physical Bluetooth peripherals whose vendor firmware payload can influence the loaded TLV.

Because the firmware is loaded from disk by a privileged kernel worker, code execution is not remote by default. However, kernel memory corruption during Bluetooth initialization can lead to denial of service or privilege escalation depending on the write payload dispatched by the EDL_TAG_ID_* handlers.

Detection Methods for CVE-2026-64573

Indicators of Compromise

KASAN vmalloc-out-of-bounds reports naming qca_download_firmware or qca_tlv_check_data in kernel logs
Bluetooth initialization failures or kernel oopses originating from the hci0 workqueue during hci_power_on
Unexpected or unsigned Qualcomm NVM firmware files present under /lib/firmware/qca/

Detection Strategies

Monitor dmesg and journalctl -k for KASAN reports, BUG traces, or panics referencing btqca.c
Audit installed kernel versions against the stable branches patched by commits 4fcfb5b2, 59fd2f07, 70354dbb, a087ed96, and c90164ca
Track file integrity on Bluetooth firmware directories to detect tampering with NVM TLV blobs

Monitoring Recommendations

Enable KASAN on test and staging kernels to surface out-of-bounds accesses in the Bluetooth stack before production rollout
Alert on repeated hci_power_on failures on endpoints with Qualcomm Bluetooth radios
Ingest kernel logs into a centralized log platform and create rules for qca_ symbol names in fault traces

How to Mitigate CVE-2026-64573

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the stable-tree commits below on all systems using Qualcomm Bluetooth drivers
Verify integrity and provenance of Qualcomm NVM firmware files in /lib/firmware/qca/ and restore vendor-signed copies where tampering is suspected
Disable the Bluetooth stack on servers and endpoints where the radio is not required until patched

Patch Information

The upstream fix rewrites the underflow-prone loop bound in qca_tlv_check_data(). Patched stable-tree commits: Kernel Git Commit 4fcfb5b, Kernel Git Commit 59fd2f0, Kernel Git Commit 70354db, Kernel Git Commit a087ed9, and Kernel Git Commit c90164c. Rebuild affected kernels and reboot to activate the fix.

Workarounds

Unload the btqca and hci_uart kernel modules on systems that do not require Bluetooth: modprobe -r btqca hci_uart
Blacklist Qualcomm Bluetooth modules in /etc/modprobe.d/ to prevent auto-load on boot
Restrict write access to /lib/firmware/ to root only and validate firmware files with vendor-provided hashes

bash

# Configuration example
# /etc/modprobe.d/blacklist-btqca.conf
blacklist btqca
blacklist hci_uart
install btqca /bin/true