CVE-2026-64549

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup()

bpa10x_setup() sends the vendor command 0xfc0e and passes the response

to bt_dev_info() and hci_set_fw_info() as a "%s" string starting at

skb->data + 1, without checking the length:

bt_dev_info(hdev, "%s", (char *)(skb->data + 1));

hci_set_fw_info(hdev, "%s", skb->data + 1);

A device that returns a one-byte response (status only) leaves

skb->data + 1 past the end of the data, and the %s walk reads adjacent

slab memory until it meets a NUL. The same happens when the payload is

not NUL-terminated within skb->len. The out-of-bounds bytes end up in

the kernel log and the firmware-info debugfs file.

Print the revision string with a bounded "%.*s" limited to skb->len - 1

instead. This keeps the string readable for well-behaved devices while

never reading past the received data, and does not fail setup, so a

device returning a short or unterminated

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References