CVE-2026-53255

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: MGMT: validate advertising TLV before type checks

tlv_data_is_valid() reads each advertising data field length from

data[i], then inspects data[i + 1] for managed EIR types before

checking that the current field still fits inside the supplied buffer.

A malformed field whose length byte is the last byte of the buffer can

therefore make the parser read one byte past the advertising data.

KASAN reported the following when a malformed MGMT_OP_ADD_ADVERTISING

request reached that path:

BUG: KASAN: vmalloc-out-of-bounds in tlv_data_is_valid()

Read of size 1

Call trace:

tlv_data_is_valid()

add_advertising()

hci_mgmt_cmd()

hci_sock_sendmsg()

Move the existing element-length check before any type-octet inspection

so each non-empty element is proven to contain its type byte before the

parser looks at data[i + 1].

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References