CVE-2026-64573

CVE CVE-2026-64573EUVD EUVD-2026-53267Published 2026-08-05T08:08:09.000Z

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: qca: fix NVM tag length underflow in TLV parser In the TLV_TYPE_NVM branch of qca_tlv_check_data() the tag loop bound is "while (idx < length - sizeof(struct tlv_type_nvm))". "length" is a signed int from the firmware TLV header and sizeof(struct tlv_type_nvm) is a size_t (12), so "length" is converted to size_t and any firmware-supplied "length" < 12 makes the subtraction wrap to a huge value. The loop body then reads a 12-byte struct tlv_type_nvm past the end of the short vmalloc'd firmware buffer (and the EDL_TAG_ID_* handlers can write past it). Rewrite the bound as "idx + sizeof(struct tlv_type_nvm) <= length"; both operands are non-negative, so it no longer underflows and a "length" too small for one record correctly skips the loop. BUG: KASAN: vmalloc-out-of-bounds in qca_download_firmware.isra.0 (drivers/bluetooth/btqca.c:421) Read of size 2 at addr ffffc900000e5004 by task kworker/u9:0/52 Workqueue: hci0 hci_power_on Call Trace: ... kasan_report (mm/kasan/report.c:595) qca_download_firmware.isra.0 (drivers/bluetooth/btqca.c:421 drivers/bluetooth/btqca.c:617) qca_uart_setup (drivers/bluetooth/btqca.c:948) qca_setup (drivers/bluetooth/hci_qca.c:2029) hci_uart_setup (drivers/bluetooth/hci_ldisc.c:438) hci_dev_open_sync (net/bluetooth/hci_sync.c:5227) hci_power_on (net/bluetooth/hci_core.c:920) process_one_work (kernel/workqueue.c:3322) worker_thread (kernel/workqueue.c:3486) kthread (kernel/kthread.c:436) ret_from_fork (arch/x86/kernel/process.c:158) ret_from_fork_asm (arch/x86/entry/entry_64.S:245)

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

• Linux — Linux patch: 6.6.148; 2e4edfa1e2bd821a317e7d006517dcf2f3fac68d <a087ed960fce54e9302796229e9d545bbc9bcd4a; 5.15.159 <5.16; 427281f9498ed614f9aabc80e46ec077c487da6d <70354dbb5f72d9a76da7b031de3cbaf6c7d8fc24; 2e4edfa1e2bd821a317e7d006517dcf2f3fac68d <c90164ca0f7036942ba088eb7ea8d3f6c2352020; 2e4edfa1e2bd821a317e7d006517dcf2f3fac68d <4fcfb5b2c736785464ff9745f94c6726c5ee2d85; patch: 0; patch: 7.1.6; ed53949cc92e28aaa3463d246942bda1fbb7f307; patch: 7.2-rc4; 6.9; patch: 6.18.42; 2e4edfa1e2bd821a317e7d006517dcf2f3fac68d <59fd2f075bca94f030c7c78e94878ea0803d7690; 6.8.10 <6.9; 6.6.31 <6.6.148; 6.1.91 <6.2; patch: 6.12.101; 1caceadfb50432dbf6d808796cb6c34ebb6d662c; 02f05ed44b71152d5e11d29be28aed91c0489b4e

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

• Linux — Linux

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.