CVE-2026-64549

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup()<br /> <br /> bpa10x_setup() sends the vendor command 0xfc0e and passes the response<br /> to bt_dev_info() and hci_set_fw_info() as a "%s" string starting at<br /> skb-&gt;data + 1, without checking the length:<br /> <br /> bt_dev_info(hdev, "%s", (char *)(skb-&gt;data + 1));<br /> hci_set_fw_info(hdev, "%s", skb-&gt;data + 1);<br /> <br /> A device that returns a one-byte response (status only) leaves<br /> skb-&gt;data + 1 past the end of the data, and the %s walk reads adjacent<br /> slab memory until it meets a NUL. The same happens when the payload is<br /> not NUL-terminated within skb-&gt;len. The out-of-bounds bytes end up in<br /> the kernel log and the firmware-info debugfs file.<br /> <br /> Print the revision string with a bounded "%.*s" limited to skb-&gt;len - 1<br /> instead. This keeps the string readable for well-behaved devices while<br /> never reading past the received data, and does not fail setup, so a<br /> device returning a short or unterminated response keeps working.