CVE-2026-64407

A flaw was found in the Linux kernel's Bluetooth driver. A malicious Bluetooth controller could send a specially crafted firmware download request that causes an out-of-bounds read. This allows the driver to read memory beyond the intended firmware data and send it back over the Universal Asynchronous Receiver-Transmitter (UART), leading to information disclosure.

Red Hat rates this vulnerability as Moderate severity because exploitation requires an attacker to possess local access to an attached physical or emulated NXP serial Bluetooth controller to trigger the out-of-bounds read during firmware loading. The potential blast radius is limited to unauthorized information disclosure of kernel memory across the serial connection, without granting arbitrary code execution or privilege escalation. Furthermore, default Red Hat Enterprise Linux configurations do not ship or enable this driver.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.