CVE-2026-64539 Linux CVE debrief

Who should care

System administrators and users with CAP_NET_ADMIN access on systems with Bluetooth LE-only controllers, as well as Linux kernel maintainers and developers, should be aware of this vulnerability. They should assess their systems for exposure and apply mitigations or patches as necessary to prevent exploitation. Additionally, security teams and vulnerability management teams should prioritize patching and monitoring for suspicious activity related to this vulnerability. IT operators managing Linux systems with Bluetooth components should also be informed about the potential risks and necessary precautions. This includes reviewing system configurations, ensuring proper access controls are in place, and staying updated on patches and advisories from Linux vendors. Regular security audits and penetration testing can help identify potential weaknesses and ensure compliance with security best practices. Furthermore, organizations should consider implementing compensating controls, such as network segmentation and intrusion detection systems, to mitigate potential impacts in case of a successful exploit. By taking these steps, organizations can reduce the risk associated with this vulnerability and protect their systems from potential attacks. Effective communication and coordination between different teams, including IT, security, and development, are crucial in addressing this vulnerability and ensuring the overall security posture of the organization. This involves staying informed about the latest developments, sharing information, and working together to implement effective mitigations and patches across the organization. The involvement of Linux kernel maintainers and developers is also essential in providing support and guidance on patching and mitigation strategies, as well as in addressing potential issues and complexities associated with the vulnerability. Overall, a collaborative and proactive approach is necessary to effectively manage and mitigate the risks associated with this vulnerability. This includes ongoing monitoring, patch management, and security best practices to minimize the potential impacts and ensure the security and integrity of systems and

Technical summary

The eir_create_adv_data function in the Linux kernel's Bluetooth eir module does not properly check the buffer size when prepending a 'Flags' AD structure and copying instance advertising data. This can lead to a stack-out-of-bounds write when a local user with CAP_NET_ADMIN owning an LE-only controller on the legacy advertising path triggers the vulnerability. The vulnerability is caused by insufficient buffer size checks, allowing for potential exploitation by local users with CAP_NET_ADMIN access.

Defensive priority

High priority for systems with Bluetooth LE-only controllers and CAP_NET_ADMIN access

Recommended defensive actions

• Apply the kernel patch that resolves the vulnerability
• Restrict CAP_NET_ADMIN access to trusted users
• Monitor for suspicious Bluetooth advertising activity
• Review system configurations to ensure proper access controls are in place
• Perform regular security audits and penetration testing to identify potential weaknesses
• Implement compensating controls such as network segmentation and intrusion detection systems
• Track and verify patch deployment and vulnerability mitigation progress

Evidence notes

The issue arises from the eir_create_adv_data function not checking if prepending a 'Flags' AD structure and copying instance advertising data would exceed the buffer size. A local user with CAP_NET_ADMIN can trigger this vulnerability on an LE-only controller using the legacy advertising path. To verify, defenders should review the kernel patch and assess their systems for exposure.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.