---
cve: "CVE-2026-64549"
severity: "LOW"
cvss: 3.1
epss: "0.2%"
vendor: "Linux"
kev: false
exploited: false
published: "2026-07-27 20:10:38"
tags: [cve, security, low]
source: tsecurity.de CVE-Dossier
exported: "2026-09-20T20:04:42+02:00"
---

# CVE-2026-64549

> 3.1 LOW

## Beschreibung

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup()

bpa10x_setup() sends the vendor command 0xfc0e and passes the response
to bt_dev_info() and hci_set_fw_info() as a "%s" string starting at
skb->data + 1, without checking the length:

	bt_dev_info(hdev, "%s", (char *)(skb->data + 1));
	hci_set_fw_info(hdev, "%s", skb->data + 1);

A device that returns a one-byte response (status only) leaves
skb->data + 1 past the end of the data, and the %s walk reads adjacent
slab memory until it meets a NUL. The same happens when the payload is
not NUL-terminated within skb->len. The out-of-bounds bytes end up in
the kernel log and the firmware-info debugfs file.

Print the revision string with a bounded "%.*s" limited to skb->len - 1
instead. This keeps the string readable for well-behaved devices while
never reading past the received data, and does not fail setup, so a
device returning a short or unterminated response keeps working.

## Patch verfügbar (OSV)

- Kernel ≥ 5.10.261
- Kernel ≥ 5.15.212
- Kernel ≥ 6.1.178
- Kernel ≥ 6.6.145
- Kernel ≥ 6.12.97
- Kernel ≥ 6.18.40
- Kernel ≥ 7.1.5

## Referenzen

- <https://git.kernel.org/stable/c/1813add71e386f77b3040e6c8dc9b7b3ff965a6c>
- <https://git.kernel.org/stable/c/bd56c23f1f8681a2857ee924a8bd3abf87c8913b>
- <https://git.kernel.org/stable/c/7a64f39ebe1bacd9004a62eceadac0b122ec3cc2>
- <https://git.kernel.org/stable/c/f80b4afe893dffa9fabdbf80fb4d6782b24a6793>
- <https://git.kernel.org/stable/c/4b4008dda1d0c6e598d7865631ad4eda63a560f0>
- <https://git.kernel.org/stable/c/bfc9e7be289df11e8e38c98cd78019d67fdd0bd5>
- <https://git.kernel.org/stable/c/a8e169d308775039200bb9c905c7ce420db6e8c5>
- <https://git.kernel.org/stable/c/dd068ef044128db655f48323a4acfd5907e04903>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2026-64549) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_