CVE-2026-64549 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Bluetooth device manufacturers, organizations using Linux-based systems with Bluetooth capabilities, and security teams responsible for vulnerability management and incident response. These stakeholders should review the vulnerability details and assess the potential impact on their systems and products. They should also prioritize applying patches or mitigations to prevent exploitation of the vulnerability. Additionally, security teams should monitor kernel logs and firmware-info debugfs files for potential sensitive data leaks and implement compensating controls as needed. Affected product operators should verify the presence of vulnerable Bluetooth components and coordinate with vendors for support. Platform administrators should ensure that necessary updates are applied and verify the effectiveness of the patches. Vulnerability management teams should track the vulnerability and ensure that it is properly addressed in their systems. Incident response teams should be prepared to respond to potential exploitation attempts and have plans in place to mitigate the impact of a successful exploit. Security teams should also review the CVE record and vendor guidance to validate affected scope, severity, and recommended actions. They should plan and implement vendor-supported updates or mitigations through normal change control where exposure is confirmed. Compensating controls should be reviewed and implemented for exposed systems while remediation is scheduled and verified. Monitoring, detection, and logs should be checked for exposed assets that need extra review. Exceptions should be tracked, and remediated assets should be retested and closed only after evidence is documented. Asset inventory and configuration management should be updated to reflect the presence of vulnerable components. Source tracking and monitoring should be implemented to detect potential exploitation attempts. Rollback and change windows should be planned and implemented as needed to ensure the timely application of patches and mitigations. The Linux kernel community should review and apply the provided patches to the Linux kernel. Input validation,

Technical summary

The bpa10x_setup() function in the Linux kernel's Bluetooth component does not properly validate the length of the response from the vendor command, leading to a potential out-of-bounds read of adjacent slab memory. This issue can result in sensitive data being leaked into the kernel log and firmware-info debugfs file. The vulnerability has been resolved by printing the revision string with a bounded '%.*s' format specifier, limited to skb->len - 1.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the provided patches to the Linux kernel
• Implement input validation and bounds checking for the bpa10x_setup() function
• Monitor kernel logs and firmware-info debugfs file for potential sensitive data leaks
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability exists in the Linux kernel's Bluetooth bpa10x component. The bpa10x_setup() function does not properly validate the length of the response from the vendor command, which can lead to an out-of-bounds read. This issue has been resolved by printing the revision string with a bounded '%.*s' format specifier, limited to skb->len - 1.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.