CVE-2026-64573

A flaw was found in the Linux kernel's Bluetooth subsystem, specifically within the qca driver. A local attacker could exploit an integer underflow vulnerability in the NVM tag length parser by providing specially crafted firmware data. This could lead to an out-of-bounds memory write, potentially allowing for arbitrary code execution or causing a system crash (Denial of Service).

A moderate severity flaw was found in the Linux kernel's Qualcomm Atheros (qca) Bluetooth driver. In the TLV_TYPE_NVM branch of qca_tlv_check_data(), the tag loop bound is computed as "length - sizeof(struct tlv_type_nvm)"; because the firmware-supplied signed "length" is converted to size_t, any NVM length smaller than the 12-byte struct makes the subtraction wrap to a huge value. The loop then reads a 12-byte struct tlv_type_nvm past the end of the vmalloc'd firmware buffer during Bluetooth controller setup, and the EDL_TAG_ID_* tag handlers can write past the buffer. Exploiting this requires loading specially crafted firmware data for a qca-based Bluetooth controller and could cause an out-of-bounds read or write, leading to a kernel crash (denial of service) or, in the worst case, kernel memory corruption. The Red Hat CVSS 3.1 score of 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects that exploitation requires local access with the ability to trigger Bluetooth power-on with a malformed firmware image and is not directly reachable over the Bluetooth radio, which is lower than the worst-case arbitrary-code-execution assessment in the upstream CVE description. All Red Hat Enterprise Linux (RHEL 6 through 10, kernel and kernel-rt) and Red Hat In-Vehicle OS (kernel and kernel-ivos-qualcomm) streams in scope are marked not affected because the vulnerable code is not present in those builds.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.