CVE-2026-64126

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: MGMT: validate Add Extended Advertising Data length

MGMTOPADDEXTADVDATA is registered as a variable-length command, with MGMTADDEXTADVDATASIZE as the fixed header size. The handler then uses cp->advdatalen and cp->scanrsplen to validate and copy cp->data, but it never checks that those bytes are part of the mgmt command payload.

A short command can therefore make addextadvdata() pass an out-of-bounds pointer into tlvdataisvalid(). If the bytes beyond the command buffer are addressable, they can also be copied into the advertising instance as scan response data, where the caller can read them back via MGMTOPGETADVINSTANCE. The trigger requires CAPNETADMIN in the initial user namespace; KASAN reports an 8-byte slab-out-of-bounds read.

Reject commands whose length does not match the fixed header plus both advertising data lengths before parsing cp->data.