CVE-2026-89583

A flaw was found in the Linux kernel's Bluetooth subsystem. An out-of-bounds (OOB) read vulnerability exists in the eir_get_service_data() function due to incorrect length calculation when parsing Extended Inquiry Response (EIR) advertising data. A remote attacker, by sending a specially crafted periodic advertising payload, could exploit this to read sensitive information from kernel memory. This could lead to the disclosure of internal kernel data to a local user.

An OOB read in Bluetooth eir_get_service_data occurs because the parser advances the EIR pointer after a UUID mismatch but keeps an incorrect remaining length. A crafted periodic advertising payload from a nearby Bluetooth LE broadcaster can make the parser walk past hcon le_per_adv_data into adjacent bytes of struct hci_conn. If the drifted field is interpreted as matching the BAA UUID, those bytes can be copied into iso_pi(sk) base and exposed to user space through getsockopt(BT_ISO_BASE). For the CVSS the PR:N is used because the malformed advertising data can be supplied by a nearby broadcaster without credentials on the victim. The issue is adjacent network reachable over Bluetooth rather than Internet reachable. Impact is primarily information disclosure. Availability impact is only considered in the paranoid score because the primitive is an out of bounds read, not an out of bounds write or UAF.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.