CVE-2026-64403

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: validate option length before reading conf opt value l2cap_get_conf_opt() derives the option length from the attacker-controlled opt->len field and immediately dereferences opt->val (as u8, get_unaligned_le16() or get_unaligned_le32(), or a raw pointer for the default case) before any caller has confirmed that opt->len bytes are present in the buffer. The callers (l2cap_parse_conf_req(), l2cap_parse_conf_rsp() and l2cap_conf_rfc_get()) only detect a malformed option afterwards, once the running length has...

Affected product and versions

Product

Linux

Affected versions

>= 7c9cbd0b5e38a1672fcd137894ace3b042dfbf69 < cca81b4bc672604a84f6d224a55cc77ec7dee619, >= 7c9cbd0b5e38a1672fcd137894ace3b042dfbf69 < f70d4aa88068096f35d73e3a05eff33c0a16b9cd, >= 7c9cbd0b5e38a1672fcd137894ace3b042dfbf69 < 7d871e969b941ce25653f7716203a0ea4d07ad4b, >= 7c9cbd0b5e38a1672fcd137894ace3b042dfbf69 < 98d93c226bdfaa79bbdd86981921d7f106374225, >= 7c9cbd0b5e38a1672fcd137894ace3b042dfbf69 < 996d3da39899aceb8f4910911a3f19a45a7d9d1b, >= 7c9cbd0b5e38a1672fcd137894ace3b042dfbf69 < 73abbaf91aa33da87c008fb62c148ade561bb606, >= 7c9cbd0b5e38a1672fcd137894ace3b042dfbf69 < 6b47bdaacfd0045687880177e0987055d8f4765a, >= 7c9cbd0b5e38a1672fcd137894ace3b042dfbf69 < 687617555cedfb74c9e3cb85d759b908dcb17856, >= 78c2887130f1a7d1883195732be1b6cdab667487, >= ac7c597c465eb09391e40febbe088bdad601080b, >= ade4560e4fea198866e033fe1c02f063d6d7db2e, >= 99665dcf6ff803351b5e658f3a929cb498561e36, >= 2b59d36f22622c92c0b06aee7571f0a86a217188, >= 15d6538a0d6e0f6de5116081a948cba7cc3e1d3d, >= a556547bae00528f24b42786b41a14047db14b84, >= 3.16.66 < 3.17, >= 3.18.138 < 3.19, >= 4.4.178 < 4.5, >= 4.9.167 < 4.10, >= 4.14.110 < 4.15

Fixed versions

No verified fixed-version field is available yet

Technical data

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

CWE

Not available