CVE-2026-64539

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: eir: Fix stack OOB write when prepending the Flags AD

eir_create_adv_data() builds the advertising data into a fixed-size

buffer ("size", 31 for the legacy path). It may prepend a 3-byte "Flags"

AD structure (LE_AD_NO_BREDR on an LE-only controller) and then copies

the per-instance data without checking that it still fits:

memcpy(ptr, adv->adv_data, adv->adv_data_len);

tlv_data_max_len() only reserves those 3 bytes when the user-supplied

flags carry a managed-flags bit, so an instance added with flags == 0 is

accepted with adv_data_len up to the full buffer. At advertise time the

flags are still prepended, and the memcpy() writes 3 + adv_data_len

bytes into the size-byte buffer:

BUG: KASAN: stack-out-of-bounds in eir_create_adv_data (net/bluetooth/eir.c:301)

Write of size 31 at addr ffff88800a547bdc by task kworker/u9:0/65

Workqueue: hci0 hci_cmd_sync_work

__asan_memcpy (mm/kasan/shadow.c:106)

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References