CVE-2026-64126 (GCVE-0-2026-64126)

Vulnerability from cvelistv5 – Published: 2026-07-19 15:40 – Updated: 2026-08-05 12:39
VLAI
Title
Bluetooth: MGMT: validate Add Extended Advertising Data length
Summary
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: validate Add Extended Advertising Data length MGMT_OP_ADD_EXT_ADV_DATA is registered as a variable-length command, with MGMT_ADD_EXT_ADV_DATA_SIZE as the fixed header size. The handler then uses cp->adv_data_len and cp->scan_rsp_len to validate and copy cp->data, but it never checks that those bytes are part of the mgmt command payload. A short command can therefore make add_ext_adv_data() pass an out-of-bounds pointer into tlv_data_is_valid(). If the bytes beyond the command buffer are addressable, they can also be copied into the advertising instance as scan response data, where the caller can read them back via MGMT_OP_GET_ADV_INSTANCE. The trigger requires CAP_NET_ADMIN in the initial user namespace; KASAN reports an 8-byte slab-out-of-bounds read. Reject commands whose length does not match the fixed header plus both advertising data lengths before parsing cp->data.
Severity
7.3 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 12410572833a283ce92fcf9679ca8a2f372097ee , < 0d5104390b445e7bd664ad583837e4c04d892c9d (git)
Affected: 12410572833a283ce92fcf9679ca8a2f372097ee , < 14b01b9cba04e6ce82825f68fc4c4322fa4ffa43 (git)
Affected: 12410572833a283ce92fcf9679ca8a2f372097ee , < a143ce77a5292f2c9285137433d879ce71d190a7 (git)
Affected: 12410572833a283ce92fcf9679ca8a2f372097ee , < a6c75a3fad226ccbd8ef9110dee87c92c299f2ab (git)
Affected: 12410572833a283ce92fcf9679ca8a2f372097ee , < f1febe93ef075314615f970a87681d9ab86691d1 (git)
Affected: 12410572833a283ce92fcf9679ca8a2f372097ee , < 0bc1a5a69f541859293d79db72bd7854ac48df51 (git)
Affected: 12410572833a283ce92fcf9679ca8a2f372097ee , < d3f7d17960ed50df3a6709c5158caff989c8c905 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.11
Unaffected: 0 , < 5.11 (semver)
Unaffected: 5.15.210 , ≤ 5.15.* (semver)
Unaffected: 6.1.175 , ≤ 6.1.* (semver)
Unaffected: 6.6.142 , ≤ 6.6.* (semver)
Unaffected: 6.12.92 , ≤ 6.12.* (semver)
Unaffected: 6.18.34 , ≤ 6.18.* (semver)
Unaffected: 7.0.11 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/mgmt.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0d5104390b445e7bd664ad583837e4c04d892c9d",
              "status": "affected",
              "version": "12410572833a283ce92fcf9679ca8a2f372097ee",
              "versionType": "git"
            },
            {
              "lessThan": "14b01b9cba04e6ce82825f68fc4c4322fa4ffa43",
              "status": "affected",
              "version": "12410572833a283ce92fcf9679ca8a2f372097ee",
              "versionType": "git"
            },
            {
              "lessThan": "a143ce77a5292f2c9285137433d879ce71d190a7",
              "status": "affected",
              "version": "12410572833a283ce92fcf9679ca8a2f372097ee",
              "versionType": "git"
            },
            {
              "lessThan": "a6c75a3fad226ccbd8ef9110dee87c92c299f2ab",
              "status": "affected",
              "version": "12410572833a283ce92fcf9679ca8a2f372097ee",
              "versionType": "git"
            },
            {
              "lessThan": "f1febe93ef075314615f970a87681d9ab86691d1",
              "status": "affected",
              "version": "12410572833a283ce92fcf9679ca8a2f372097ee",
              "versionType": "git"
            },
            {
              "lessThan": "0bc1a5a69f541859293d79db72bd7854ac48df51",
              "status": "affected",
              "version": "12410572833a283ce92fcf9679ca8a2f372097ee",
              "versionType": "git"
            },
            {
              "lessThan": "d3f7d17960ed50df3a6709c5158caff989c8c905",
              "status": "affected",
              "version": "12410572833a283ce92fcf9679ca8a2f372097ee",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/mgmt.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.11"
            },
            {
              "lessThan": "5.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.142",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.92",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.210",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.142",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.92",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.34",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.11",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: MGMT: validate Add Extended Advertising Data length\n\nMGMT_OP_ADD_EXT_ADV_DATA is registered as a variable-length command,\nwith MGMT_ADD_EXT_ADV_DATA_SIZE as the fixed header size.  The handler\nthen uses cp-\u003eadv_data_len and cp-\u003escan_rsp_len to validate and copy\ncp-\u003edata, but it never checks that those bytes are part of the mgmt\ncommand payload.\n\nA short command can therefore make add_ext_adv_data() pass an\nout-of-bounds pointer into tlv_data_is_valid().  If the bytes beyond\nthe command buffer are addressable, they can also be copied into the\nadvertising instance as scan response data, where the caller can read\nthem back via MGMT_OP_GET_ADV_INSTANCE.  The trigger requires\nCAP_NET_ADMIN in the initial user namespace; KASAN reports an 8-byte\nslab-out-of-bounds read.\n\nReject commands whose length does not match the fixed header plus both\nadvertising data lengths before parsing cp-\u003edata."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only through a local Bluetooth MGMT socket (AF_BLUETOOTH, HCI_CHANNEL_CONTROL) via sendmsg(), not from remote Bluetooth air traffic or network protocols.\nAC:L - An attacker fully controls the malformed MGMT command and length fields and can retry reliably; no race or victim-dependent timing is required to trigger the out-of-bounds read and copy.\nPR:L - Exploitation requires CAP_NET_ADMIN to obtain an HCI_SOCK_TRUSTED MGMT socket, which is reachable by an unprivileged user via user namespaces (e.g. unshare with CAP_NET_ADMIN) on the CONTROL-channel bind path.\nUI:N - No victim interaction is required; the attacker triggers the flaw directly by sending a crafted MGMT_OP_ADD_EXT_ADV_DATA command.\nS:U - Impact is confined to kernel memory disclosure and modification of Bluetooth advertising state within the same kernel security boundary, with no VM escape or cross-authority boundary crossing.\nC:H - A short command causes slab out-of-bounds reads (KASAN-reported) via tlv_data_is_valid(), and addressable bytes beyond the command buffer can be copied into scan response data and potentially exfiltrated over BLE advertising.\nI:H - The out-of-bounds pointer is used in memcpy() into kernel advertising structures, constituting kernel memory corruption with attacker-influenced content that can alter system-controlled Bluetooth data.\nA:L - While the primary impact is information disclosure, out-of-bounds kernel memory access can cause oopses or instability on some layouts; when uncertain, availability impact is rated above none."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:39:32.975Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0d5104390b445e7bd664ad583837e4c04d892c9d"
        },
        {
          "url": "https://git.kernel.org/stable/c/14b01b9cba04e6ce82825f68fc4c4322fa4ffa43"
        },
        {
          "url": "https://git.kernel.org/stable/c/a143ce77a5292f2c9285137433d879ce71d190a7"
        },
        {
          "url": "https://git.kernel.org/stable/c/a6c75a3fad226ccbd8ef9110dee87c92c299f2ab"
        },
        {
          "url": "https://git.kernel.org/stable/c/f1febe93ef075314615f970a87681d9ab86691d1"
        },
        {
          "url": "https://git.kernel.org/stable/c/0bc1a5a69f541859293d79db72bd7854ac48df51"
        },
        {
          "url": "https://git.kernel.org/stable/c/d3f7d17960ed50df3a6709c5158caff989c8c905"
        }
      ],
      "title": "Bluetooth: MGMT: validate Add Extended Advertising Data length",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64126",
    "datePublished": "2026-07-19T15:40:23.276Z",
    "dateReserved": "2026-07-19T07:54:57.036Z",
    "dateUpdated": "2026-08-05T12:39:32.975Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-64126",
      "date": "2026-09-20",
      "epss": "0.00135",
      "percentile": "0.03349"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/bluetooth/mgmt.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "0d5104390b445e7bd664ad583837e4c04d892c9d",
                    "status": "affected",
                    "version": "12410572833a283ce92fcf9679ca8a2f372097ee",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "14b01b9cba04e6ce82825f68fc4c4322fa4ffa43",
                    "status": "affected",
                    "version": "12410572833a283ce92fcf9679ca8a2f372097ee",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a143ce77a5292f2c9285137433d879ce71d190a7",
                    "status": "affected",
                    "version": "12410572833a283ce92fcf9679ca8a2f372097ee",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a6c75a3fad226ccbd8ef9110dee87c92c299f2ab",
                    "status": "affected",
                    "version": "12410572833a283ce92fcf9679ca8a2f372097ee",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f1febe93ef075314615f970a87681d9ab86691d1",
                    "status": "affected",
                    "version": "12410572833a283ce92fcf9679ca8a2f372097ee",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "0bc1a5a69f541859293d79db72bd7854ac48df51",
                    "status": "affected",
                    "version": "12410572833a283ce92fcf9679ca8a2f372097ee",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d3f7d17960ed50df3a6709c5158caff989c8c905",
                    "status": "affected",
                    "version": "12410572833a283ce92fcf9679ca8a2f372097ee",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/bluetooth/mgmt.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.11"
                  },
                  {
                    "lessThan": "5.11",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.210",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.175",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.142",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.92",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.34",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.0.*",
                    "status": "unaffected",
                    "version": "7.0.11",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "5E938CDF-D1C4-43D0-98DC-9E11B6B55801",
                    "versionEndExcluding": "5.15.210",
                    "versionStartIncluding": "5.11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "92385813-D91D-480D-83A1-F423D2CBB2BA",
                    "versionEndExcluding": "6.1.175",
                    "versionStartIncluding": "5.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "FBFF77B0-526A-4AF1-84D0-ED7187624A67",
                    "versionEndExcluding": "6.6.142",
                    "versionStartIncluding": "6.2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "9CB90BD9-95B7-4D7F-9F17-4ECE6CFB66C9",
                    "versionEndExcluding": "6.12.92",
                    "versionStartIncluding": "6.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A4B1EF6D-18D7-4838-BC37-7499D5DCC3C0",
                    "versionEndExcluding": "6.18.34",
                    "versionStartIncluding": "6.13",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "0520D091-FC52-4A50-AF07-70AE7D08B750",
                    "versionEndExcluding": "7.0.11",
                    "versionStartIncluding": "6.19",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "EC732D08-5F7B-46D9-B154-E60C7F4F0A97",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*",
                    "matchCriteriaId": "E5910A9D-F60A-409A-B486-FE66BFEBA9B9",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: MGMT: validate Add Extended Advertising Data length\n\nMGMT_OP_ADD_EXT_ADV_DATA is registered as a variable-length command,\nwith MGMT_ADD_EXT_ADV_DATA_SIZE as the fixed header size.  The handler\nthen uses cp-\u003eadv_data_len and cp-\u003escan_rsp_len to validate and copy\ncp-\u003edata, but it never checks that those bytes are part of the mgmt\ncommand payload.\n\nA short command can therefore make add_ext_adv_data() pass an\nout-of-bounds pointer into tlv_data_is_valid().  If the bytes beyond\nthe command buffer are addressable, they can also be copied into the\nadvertising instance as scan response data, where the caller can read\nthem back via MGMT_OP_GET_ADV_INSTANCE.  The trigger requires\nCAP_NET_ADMIN in the initial user namespace; KASAN reports an 8-byte\nslab-out-of-bounds read.\n\nReject commands whose length does not match the fixed header plus both\nadvertising data lengths before parsing cp-\u003edata."
          }
        ],
        "id": "CVE-2026-64126",
        "lastModified": "2026-08-13T15:11:16.750",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "LOW",
                "baseScore": 7.3,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.5,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-07-19T16:17:54.260",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/0bc1a5a69f541859293d79db72bd7854ac48df51"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/0d5104390b445e7bd664ad583837e4c04d892c9d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/14b01b9cba04e6ce82825f68fc4c4322fa4ffa43"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/a143ce77a5292f2c9285137433d879ce71d190a7"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/a6c75a3fad226ccbd8ef9110dee87c92c299f2ab"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/d3f7d17960ed50df3a6709c5158caff989c8c905"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/f1febe93ef075314615f970a87681d9ab86691d1"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-125"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-20T16:46:44+00:00",
      "cve": "CVE-2026-64126",
      "id": "CVE-2026-64126",
      "initial_release_date": "2026-07-19T00:00:00+00:00",
      "product_status:known_affected": "232",
      "product_status:known_not_affected": "43",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Bluetooth: MGMT: validate Add Extended Advertising Data length",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64126.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-18T00:43:43Z",
      "cve": "CVE-2026-64126",
      "id": "CVE-2026-64126",
      "initial_release_date": "2026-07-21T12:59:13Z",
      "product_status:known_affected": "528",
      "product_status:known_not_affected": "205",
      "product_status:recommended": "107",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-64126",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-64126.json",
      "version": "8"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.