CVE-2026-53209 (GCVE-0-2026-53209)
Vulnerability from cvelistv5
Published
2026-06-25 08:39
Modified
2026-08-05 12:34
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend Existing advertising instances can already hold the maximum extended advertising payload. When hci_adv_bcast_annoucement() prepends the Broadcast Announcement service data to that payload, the combined data may no longer fit in the temporary buffer used to rebuild the advertising data. Reject that case before copying the existing payload and report the failure through the device log. This keeps the existing advertising data intact and avoids overrunning the temporary buffer.
References
Impacted products
Vendor Product Version
Linux Linux Version: 63f365eb4d1668a04070151b555d55a07ede8d4b
Version: c621211b308816889f0a3246de448bfcef8ab3ab
Version: 907ef6e12fb558a0763e894311eb245a94c192dd
Version: 5725bc608252050ed8a4d47d59225b7dd73474c8
Version: 5725bc608252050ed8a4d47d59225b7dd73474c8
Version: 5725bc608252050ed8a4d47d59225b7dd73474c8
Version: 15da883c010cbc2a84aec1738b6ad6ee477846de
Version: 6.1.142   ≤
Version: 6.6.94   ≤
Version: 6.12.34   ≤
Version: 6.15.3   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/hci_sync.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "10b0e832cc05d7aef4b92bed912cbd4a395d0862",
              "status": "affected",
              "version": "63f365eb4d1668a04070151b555d55a07ede8d4b",
              "versionType": "git"
            },
            {
              "lessThan": "1338ee049a8910ba6c9cee963920e978e6893c7d",
              "status": "affected",
              "version": "c621211b308816889f0a3246de448bfcef8ab3ab",
              "versionType": "git"
            },
            {
              "lessThan": "02f50e8bb69f9b22516163a09922f5537d3b12d1",
              "status": "affected",
              "version": "907ef6e12fb558a0763e894311eb245a94c192dd",
              "versionType": "git"
            },
            {
              "lessThan": "dafc9f57140e66a10945127aa7433c3d715dc253",
              "status": "affected",
              "version": "5725bc608252050ed8a4d47d59225b7dd73474c8",
              "versionType": "git"
            },
            {
              "lessThan": "cdd8bbdbee763fdf5bf343e6f7d4e79347739f62",
              "status": "affected",
              "version": "5725bc608252050ed8a4d47d59225b7dd73474c8",
              "versionType": "git"
            },
            {
              "lessThan": "5c65b96b549ea2dcfde497436bf9e048deb87758",
              "status": "affected",
              "version": "5725bc608252050ed8a4d47d59225b7dd73474c8",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "15da883c010cbc2a84aec1738b6ad6ee477846de",
              "versionType": "git"
            },
            {
              "lessThan": "6.1.176",
              "status": "affected",
              "version": "6.1.142",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.143",
              "status": "affected",
              "version": "6.6.94",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12.94",
              "status": "affected",
              "version": "6.12.34",
              "versionType": "semver"
            },
            {
              "lessThan": "6.16",
              "status": "affected",
              "version": "6.15.3",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/hci_sync.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.16"
            },
            {
              "lessThan": "6.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.94",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.36",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "6.1.142",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "6.6.94",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.94",
                  "versionStartIncluding": "6.12.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.36",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.13",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.15.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sync: reject oversized Broadcast Announcement prepend\n\nExisting advertising instances can already hold the maximum extended\nadvertising payload. When hci_adv_bcast_annoucement() prepends the\nBroadcast Announcement service data to that payload, the combined data\nmay no longer fit in the temporary buffer used to rebuild the\nadvertising data.\n\nReject that case before copying the existing payload and report the\nfailure through the device log. This keeps the existing advertising\ndata intact and avoids overrunning the temporary buffer."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is reached through local AF_BLUETOOTH HCI management/ISO socket operations that configure advertising data and start BIS/periodic advertising. It is not reachable directly from Bluetooth radio packets sent by an adjacent attacker.\nAC:L - The attacker can choose the advertising payload length/content, omit an existing Broadcast Announcement, provide BASE data that creates Basic Audio Announcement periodic data, and trigger the prepend deterministically. The needed Bluetooth LE Audio/extended advertising support is a reasonable affected deployment condition.\nPR:L - The advertising setup path requires a trusted HCI management socket via CAP_NET_ADMIN, but the code uses capable() and is therefore reachable by a basic local user with CAP_NET_ADMIN obtained in a user namespace on systems allowing unprivileged user namespaces. ISO socket triggering itself has no stronger privilege gate.\nUI:N - No victim action is required once the local attacker can issue the Bluetooth socket operations. The attacker performs both setup and trigger steps directly.\nS:U - The corruption occurs in kernel Bluetooth code and affects the same kernel security authority. This is a standard local kernel memory-corruption scenario, not a VM/IOMMU or other cross-scope boundary escape.\nC:H - The bug is an attacker-controlled kernel stack out-of-bounds write, and such memory corruption can plausibly be leveraged beyond a simple crash in less hardened configurations. Under the required uncertainty rule, confidentiality impact is scored high.\nI:H - The vulnerable memcpy writes past a fixed 251-byte stack buffer with attacker-controlled advertising bytes. Out-of-bounds kernel writes are scored as high integrity impact because they may enable control-flow or data corruption.\nA:H - At minimum, the overflow can corrupt stack state or trigger hardening checks such as stack protector/FORTIFY, causing an oops or panic. The attacker can repeat the local trigger to deny service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:34:09.314Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/10b0e832cc05d7aef4b92bed912cbd4a395d0862"
        },
        {
          "url": "https://git.kernel.org/stable/c/1338ee049a8910ba6c9cee963920e978e6893c7d"
        },
        {
          "url": "https://git.kernel.org/stable/c/02f50e8bb69f9b22516163a09922f5537d3b12d1"
        },
        {
          "url": "https://git.kernel.org/stable/c/dafc9f57140e66a10945127aa7433c3d715dc253"
        },
        {
          "url": "https://git.kernel.org/stable/c/cdd8bbdbee763fdf5bf343e6f7d4e79347739f62"
        },
        {
          "url": "https://git.kernel.org/stable/c/5c65b96b549ea2dcfde497436bf9e048deb87758"
        }
      ],
      "title": "Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-53209",
    "datePublished": "2026-06-25T08:39:14.915Z",
    "dateReserved": "2026-06-09T07:44:35.391Z",
    "dateUpdated": "2026-08-05T12:34:09.314Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.