CVE-2026-53255

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> Bluetooth: MGMT: validate advertising TLV before type checks<br /> <br /> tlv_data_is_valid() reads each advertising data field length from<br /> data[i], then inspects data[i + 1] for managed EIR types before<br /> checking that the current field still fits inside the supplied buffer.<br /> <br /> A malformed field whose length byte is the last byte of the buffer can<br /> therefore make the parser read one byte past the advertising data.<br /> <br /> KASAN reported the following when a malformed MGMT_OP_ADD_ADVERTISING<br /> request reached that path:<br /> <br /> BUG: KASAN: vmalloc-out-of-bounds in tlv_data_is_valid()<br /> Read of size 1<br /> Call trace:<br /> tlv_data_is_valid()<br /> add_advertising()<br /> hci_mgmt_cmd()<br /> hci_sock_sendmsg()<br /> <br /> Move the existing element-length check before any type-octet inspection<br /> so each non-empty element is proven to contain its type byte before the<br /> parser looks at data[i + 1].