CVE-2026-64573

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: qca: fix NVM tag length underflow in TLV parser

In the TLV_TYPE_NVM branch of qca_tlv_check_data() the tag loop bound is

"while (idx < length - sizeof(struct tlv_type_nvm))". "length" is a signed

int from the firmware TLV header and sizeof(struct tlv_type_nvm) is a

size_t (12), so "length" is converted to size_t and any firmware-supplied

"length" < 12 makes the subtraction wrap to a huge value. The loop body

then reads a 12-byte struct tlv_type_nvm past the end of the short

vmalloc'd firmware buffer (and the EDL_TAG_ID_* handlers can write past it).

Rewrite the bound as "idx + sizeof(struct tlv_type_nvm) <= length"; both

operands are non-negative, so it no longer underflows and a "length" too

small for one record correctly skips the loop.

BUG: KASAN: vmalloc-out-of-bounds in qca_download_firmware.isra.0 (drivers/bluetooth/btqca.c:421)

Read of size 2 at addr ffffc900000e5004 by task kworker/u9:0/52

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References