CVE-2026-64126

A flaw was found in the Linux kernel's Bluetooth Management (MGMT) subsystem. The handler for the MGMT_OP_ADD_EXT_ADV_DATA command does not correctly validate the lengths of extended advertising data and scan response data against the overall command payload. This oversight allows a local attacker with CAP_NET_ADMIN capabilities to craft a specially malformed command. Successful exploitation can lead to an out-of-bounds read, resulting in information disclosure where sensitive data beyond the command buffer may be exposed.

Red Hat has evaluated this vulnerability as having Moderate severity because successful exploitation requires local execution with administrative privileges, specifically CAP_NET_ADMIN in the initial user namespace. Although a privileged attacker could induce an out-of-bounds read within the kernel Bluetooth management subsystem to leak memory or crash the system, the prerequisite of holding high network capabilities restricts the threat surface. Environments adhering to standard enterprise privilege separation or those without active Bluetooth configurations are not exposed to unprivileged exploitation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.