CVE-2026-64407

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3()<br /> <br /> During the v3 firmware download the controller sends a v3_data_req with a<br /> 32 bit offset and a 16 bit len. nxp_recv_fw_req_v3() checks only the lower<br /> bound of the offset and then sends firmware from that offset.<br /> <br /> nxpdev-&gt;fw_dnld_v3_offset = offset - nxpdev-&gt;fw_v3_offset_correction;<br /> serdev_device_write_buf(nxpdev-&gt;serdev, nxpdev-&gt;fw-&gt;data +<br /> nxpdev-&gt;fw_dnld_v3_offset, len);<br /> <br /> Nothing checks that fw_dnld_v3_offset + len stays within nxpdev-&gt;fw-&gt;size,<br /> so a controller that asks for an offset or length past the firmware image<br /> makes the driver read past the end of nxpdev-&gt;fw-&gt;data and send that<br /> memory back over UART.<br /> <br /> nxp_recv_fw_req_v1() already bounds the same write. Add the equivalent<br /> check to the v3 path, reject the request when it falls outside the firmware<br /> image, and zero len on the error path so the fw_v3_prev_sent bookkeeping at<br /> free_skb stays consistent.