CVE-2026-64403

A flaw was found in the Bluetooth L2CAP (Logical Link Control and Adaptation Protocol) component of the Linux kernel. The l2cap_get_conf_opt() function, responsible for processing configuration options, does not properly validate the length of an option before attempting to read its value. This allows an attacker to control the option length, potentially leading to an out-of-bounds read of up to 4 bytes past the end of a buffer. Although current safeguards prevent immediate data leakage, this vulnerability represents a critical validate-after-use ordering bug that could be exploited in future system configurations.

A validate after use bug in Bluetooth L2CAP configuration parsing allows l2cap_get_conf_opt() to read opt val before confirming that the full attacker controlled option length is present in the buffer. A nearby remote Bluetooth peer can send a malformed L2CAP configuration option and trigger an out of bounds read of up to 4 bytes before the caller detects the malformed length. For the CVSS the PR:N is used because triggering does not require local privileges on the victim and only requires the ability to interact with the Bluetooth L2CAP path. The issue is adjacent network reachable rather than Internet reachable because Bluetooth proximity or link access is normally required. Impact is primarily denial of service or a hardened kernel warning. The worst case is limited confidentiality impact and high availability impact, not privilege escalation, because the patch shows an out of bounds read but not a write primitive or UAF.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.