CVE-2026-64539

A flaw was found in the Linux kernel's Bluetooth subsystem. A local attacker with administrative network privileges can trigger this vulnerability when configuring legacy advertising on a Bluetooth Low Energy (LE) controller. The kernel prepends internal flag structures to advertising packets without validating that sufficient buffer space remains, resulting in a stack-based buffer overflow. The primary consequence is a system crash causing a Denial of Service (DoS), with the potential for kernel memory corruption and elevated privileges.

This vulnerability is rated as having a Moderate impact for Red Hat Enterprise Linux because exploitation requires a local attacker to possess administrative capabilities (specifically CAP_NET_ADMIN) alongside an active Bluetooth Low Energy controller configured for legacy advertising. Under typical Red Hat Enterprise Linux server deployments, Bluetooth hardware is absent or the subsystem remains inactive, significantly reducing exposure. While memory corruption can lead to kernel instability or elevated privileges, the strict prerequisites constrain the realistic attack vector.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.