CVE-2026-53255 (GCVE-0-2026-53255)
Vulnerability from cvelistv5
Published
2026-06-25 08:39
Modified
2026-06-25 08:39
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: validate advertising TLV before type checks tlv_data_is_valid() reads each advertising data field length from data[i], then inspects data[i + 1] for managed EIR types before checking that the current field still fits inside the supplied buffer. A malformed field whose length byte is the last byte of the buffer can therefore make the parser read one byte past the advertising data. KASAN reported the following when a malformed MGMT_OP_ADD_ADVERTISING request reached that path: BUG: KASAN: vmalloc-out-of-bounds in tlv_data_is_valid() Read of size 1 Call trace: tlv_data_is_valid() add_advertising() hci_mgmt_cmd() hci_sock_sendmsg() Move the existing element-length check before any type-octet inspection so each non-empty element is proven to contain its type byte before the parser looks at data[i + 1].
References
Impacted products
Vendor Product Version
Linux Linux Version: 2bb36870e8cb29949ef9acec37129cd8e70f1857
Version: 2bb36870e8cb29949ef9acec37129cd8e70f1857
Version: 2bb36870e8cb29949ef9acec37129cd8e70f1857
Version: 2bb36870e8cb29949ef9acec37129cd8e70f1857
Version: 2bb36870e8cb29949ef9acec37129cd8e70f1857
Version: 2bb36870e8cb29949ef9acec37129cd8e70f1857
Version: 2bb36870e8cb29949ef9acec37129cd8e70f1857
Version: 2bb36870e8cb29949ef9acec37129cd8e70f1857
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/mgmt.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "13ad995071a06570668dd8daab3616c247c72080",
              "status": "affected",
              "version": "2bb36870e8cb29949ef9acec37129cd8e70f1857",
              "versionType": "git"
            },
            {
              "lessThan": "06fcbd79c3c360a50f9be9d370769bbd738d0976",
              "status": "affected",
              "version": "2bb36870e8cb29949ef9acec37129cd8e70f1857",
              "versionType": "git"
            },
            {
              "lessThan": "f7093ac233c1e7f51d125534f46067772a113175",
              "status": "affected",
              "version": "2bb36870e8cb29949ef9acec37129cd8e70f1857",
              "versionType": "git"
            },
            {
              "lessThan": "74c08e4db35a476c3462aeb65846f955be732626",
              "status": "affected",
              "version": "2bb36870e8cb29949ef9acec37129cd8e70f1857",
              "versionType": "git"
            },
            {
              "lessThan": "18fea1cb0c2599752e908c8217490f73ddd33e00",
              "status": "affected",
              "version": "2bb36870e8cb29949ef9acec37129cd8e70f1857",
              "versionType": "git"
            },
            {
              "lessThan": "1a3c8ffbb469859b076445af44bdfa6a711d483e",
              "status": "affected",
              "version": "2bb36870e8cb29949ef9acec37129cd8e70f1857",
              "versionType": "git"
            },
            {
              "lessThan": "2a3f3ed9e198ae23c15859ace2f9ca6cfdc35b57",
              "status": "affected",
              "version": "2bb36870e8cb29949ef9acec37129cd8e70f1857",
              "versionType": "git"
            },
            {
              "lessThan": "de23fb62259aa01d294f77238ae3b835eb674413",
              "status": "affected",
              "version": "2bb36870e8cb29949ef9acec37129cd8e70f1857",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/mgmt.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.9"
            },
            {
              "lessThan": "4.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.259",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.94",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.36",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.259",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.210",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.94",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.36",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.13",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: MGMT: validate advertising TLV before type checks\n\ntlv_data_is_valid() reads each advertising data field length from\ndata[i], then inspects data[i + 1] for managed EIR types before\nchecking that the current field still fits inside the supplied buffer.\n\nA malformed field whose length byte is the last byte of the buffer can\ntherefore make the parser read one byte past the advertising data.\n\nKASAN reported the following when a malformed MGMT_OP_ADD_ADVERTISING\nrequest reached that path:\n\n  BUG: KASAN: vmalloc-out-of-bounds in tlv_data_is_valid()\n  Read of size 1\n  Call trace:\n    tlv_data_is_valid()\n    add_advertising()\n    hci_mgmt_cmd()\n    hci_sock_sendmsg()\n\nMove the existing element-length check before any type-octet inspection\nso each non-empty element is proven to contain its type byte before the\nparser looks at data[i + 1]."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-25T08:39:45.934Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/13ad995071a06570668dd8daab3616c247c72080"
        },
        {
          "url": "https://git.kernel.org/stable/c/06fcbd79c3c360a50f9be9d370769bbd738d0976"
        },
        {
          "url": "https://git.kernel.org/stable/c/f7093ac233c1e7f51d125534f46067772a113175"
        },
        {
          "url": "https://git.kernel.org/stable/c/74c08e4db35a476c3462aeb65846f955be732626"
        },
        {
          "url": "https://git.kernel.org/stable/c/18fea1cb0c2599752e908c8217490f73ddd33e00"
        },
        {
          "url": "https://git.kernel.org/stable/c/1a3c8ffbb469859b076445af44bdfa6a711d483e"
        },
        {
          "url": "https://git.kernel.org/stable/c/2a3f3ed9e198ae23c15859ace2f9ca6cfdc35b57"
        },
        {
          "url": "https://git.kernel.org/stable/c/de23fb62259aa01d294f77238ae3b835eb674413"
        }
      ],
      "title": "Bluetooth: MGMT: validate advertising TLV before type checks",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-53255",
    "datePublished": "2026-06-25T08:39:45.934Z",
    "dateReserved": "2026-06-09T07:44:35.394Z",
    "dateUpdated": "2026-06-25T08:39:45.934Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.