CVE-2026-64549

CVE CVE-2026-64549EUVD EUVD-2026-49600Published 2026-07-27T20:10:38.000Z

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup() bpa10x_setup() sends the vendor command 0xfc0e and passes the response to bt_dev_info() and hci_set_fw_info() as a "%s" string starting at skb->data + 1, without checking the length: bt_dev_info(hdev, "%s", (char *)(skb->data + 1)); hci_set_fw_info(hdev, "%s", skb->data + 1); A device that returns a one-byte response (status only) leaves skb->data + 1 past the end of the data, and the %s walk reads adjacent slab memory until it meets a NUL. The same happens when the payload is not NUL-terminated within skb->len. The out-of-bounds bytes end up in the kernel log and the firmware-info debugfs file. Print the revision string with a bounded "%.*s" limited to skb->len - 1 instead. This keeps the string readable for well-behaved devices while never reading past the received data, and does not fail setup, so a device returning a short or unterminated response keeps working.

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

Linux — Linux patch: 7.1.5; patch: 6.18.40; patch: 0; patch: 5.15.212; patch: 6.12.97; ddd68ec8f4847b460c9f580076eafe13b031a6fd <1813add71e386f77b3040e6c8dc9b7b3ff965a6c; patch: 7.2-rc3; ddd68ec8f4847b460c9f580076eafe13b031a6fd <f80b4afe893dffa9fabdbf80fb4d6782b24a6793; 4.4; patch: 5.10.261; ddd68ec8f4847b460c9f580076eafe13b031a6fd <dd068ef044128db655f48323a4acfd5907e04903; patch: 6.6.145; patch: 6.1.178; ddd68ec8f4847b460c9f580076eafe13b031a6fd <7a64f39ebe1bacd9004a62eceadac0b122ec3cc2; ddd68ec8f4847b460c9f580076eafe13b031a6fd <bfc9e7be289df11e8e38c98cd78019d67fdd0bd5; ddd68ec8f4847b460c9f580076eafe13b031a6fd <4b4008dda1d0c6e598d7865631ad4eda63a560f0; ddd68ec8f4847b460c9f580076eafe13b031a6fd <bd56c23f1f8681a2857ee924a8bd3abf87c8913b; ddd68ec8f4847b460c9f580076eafe13b031a6fd <a8e169d308775039200bb9c905c7ce420db6e8c5

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

Linux — Linux

Does this concern one of your customers?

This page cannot answer that — it does not know your estate. Whoever has recorded their environments gets the answer the morning after publication, together with a paragraph they can forward to the customer unedited.

Try it for 28 days

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.