Vulnerability-Lookup

GHSA-JFWG-QVFJ-22X4

Vulnerability from github – Published: 2026-06-25 09:31 – Updated: 2026-06-28 09:31

Details

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend

Existing advertising instances can already hold the maximum extended advertising payload. When hci_adv_bcast_annoucement() prepends the Broadcast Announcement service data to that payload, the combined data may no longer fit in the temporary buffer used to rebuild the advertising data.

Reject that case before copying the existing payload and report the failure through the device log. This keeps the existing advertising data intact and avoids overrunning the temporary buffer.

Severity

7.8 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-53209"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-787"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-25T09:16:38Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sync: reject oversized Broadcast Announcement prepend\n\nExisting advertising instances can already hold the maximum extended\nadvertising payload. When hci_adv_bcast_annoucement() prepends the\nBroadcast Announcement service data to that payload, the combined data\nmay no longer fit in the temporary buffer used to rebuild the\nadvertising data.\n\nReject that case before copying the existing payload and report the\nfailure through the device log. This keeps the existing advertising\ndata intact and avoids overrunning the temporary buffer.",
  "id": "GHSA-jfwg-qvfj-22x4",
  "modified": "2026-06-28T09:31:44Z",
  "published": "2026-06-25T09:31:21Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53209"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/02f50e8bb69f9b22516163a09922f5537d3b12d1"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/10b0e832cc05d7aef4b92bed912cbd4a395d0862"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/1338ee049a8910ba6c9cee963920e978e6893c7d"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/5c65b96b549ea2dcfde497436bf9e048deb87758"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/cdd8bbdbee763fdf5bf343e6f7d4e79347739f62"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/dafc9f57140e66a10945127aa7433c3d715dc253"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2026-53209 (GCVE-0-2026-53209)

Vulnerability from cvelistv5 – Published: 2026-06-25 08:39 – Updated: 2026-08-05 12:34

Title

Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend

Summary

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend Existing advertising instances can already hold the maximum extended advertising payload. When hci_adv_bcast_annoucement() prepends the Broadcast Announcement service data to that payload, the combined data may no longer fit in the temporary buffer used to rebuild the advertising data. Reject that case before copying the existing payload and report the failure through the device log. This keeps the existing advertising data intact and avoids overrunning the temporary buffer.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root Scorecard

References

6 references

URL	Tags
https://git.kernel.org/stable/c/10b0e832cc05d7aef…
https://git.kernel.org/stable/c/1338ee049a8910ba6…
https://git.kernel.org/stable/c/02f50e8bb69f9b225…
https://git.kernel.org/stable/c/dafc9f57140e66a10…
https://git.kernel.org/stable/c/cdd8bbdbee763fdf5…
https://git.kernel.org/stable/c/5c65b96b549ea2dcf…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 63f365eb4d1668a04070151b555d55a07ede8d4b , < 10b0e832cc05d7aef4b92bed912cbd4a395d0862 (git) Affected: c621211b308816889f0a3246de448bfcef8ab3ab , < 1338ee049a8910ba6c9cee963920e978e6893c7d (git) Affected: 907ef6e12fb558a0763e894311eb245a94c192dd , < 02f50e8bb69f9b22516163a09922f5537d3b12d1 (git) Affected: 5725bc608252050ed8a4d47d59225b7dd73474c8 , < dafc9f57140e66a10945127aa7433c3d715dc253 (git) Affected: 5725bc608252050ed8a4d47d59225b7dd73474c8 , < cdd8bbdbee763fdf5bf343e6f7d4e79347739f62 (git) Affected: 5725bc608252050ed8a4d47d59225b7dd73474c8 , < 5c65b96b549ea2dcfde497436bf9e048deb87758 (git) Affected: 15da883c010cbc2a84aec1738b6ad6ee477846de (git) Affected: 6.1.142 , < 6.1.176 (semver) Affected: 6.6.94 , < 6.6.143 (semver) Affected: 6.12.34 , < 6.12.94 (semver) Affected: 6.15.3 , < 6.16 (semver)
Linux	Linux	Affected: 6.16 Unaffected: 0 , < 6.16 (semver) Unaffected: 6.1.176 , ≤ 6.1.* (semver) Unaffected: 6.6.143 , ≤ 6.6.* (semver) Unaffected: 6.12.94 , ≤ 6.12.* (semver) Unaffected: 6.18.36 , ≤ 6.18.* (semver) Unaffected: 7.0.13 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/hci_sync.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "10b0e832cc05d7aef4b92bed912cbd4a395d0862",
              "status": "affected",
              "version": "63f365eb4d1668a04070151b555d55a07ede8d4b",
              "versionType": "git"
            },
            {
              "lessThan": "1338ee049a8910ba6c9cee963920e978e6893c7d",
              "status": "affected",
              "version": "c621211b308816889f0a3246de448bfcef8ab3ab",
              "versionType": "git"
            },
            {
              "lessThan": "02f50e8bb69f9b22516163a09922f5537d3b12d1",
              "status": "affected",
              "version": "907ef6e12fb558a0763e894311eb245a94c192dd",
              "versionType": "git"
            },
            {
              "lessThan": "dafc9f57140e66a10945127aa7433c3d715dc253",
              "status": "affected",
              "version": "5725bc608252050ed8a4d47d59225b7dd73474c8",
              "versionType": "git"
            },
            {
              "lessThan": "cdd8bbdbee763fdf5bf343e6f7d4e79347739f62",
              "status": "affected",
              "version": "5725bc608252050ed8a4d47d59225b7dd73474c8",
              "versionType": "git"
            },
            {
              "lessThan": "5c65b96b549ea2dcfde497436bf9e048deb87758",
              "status": "affected",
              "version": "5725bc608252050ed8a4d47d59225b7dd73474c8",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "15da883c010cbc2a84aec1738b6ad6ee477846de",
              "versionType": "git"
            },
            {
              "lessThan": "6.1.176",
              "status": "affected",
              "version": "6.1.142",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.143",
              "status": "affected",
              "version": "6.6.94",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12.94",
              "status": "affected",
              "version": "6.12.34",
              "versionType": "semver"
            },
            {
              "lessThan": "6.16",
              "status": "affected",
              "version": "6.15.3",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/hci_sync.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.16"
            },
            {
              "lessThan": "6.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.94",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.36",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "6.1.142",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "6.6.94",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.94",
                  "versionStartIncluding": "6.12.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.36",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.13",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.15.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sync: reject oversized Broadcast Announcement prepend\n\nExisting advertising instances can already hold the maximum extended\nadvertising payload. When hci_adv_bcast_annoucement() prepends the\nBroadcast Announcement service data to that payload, the combined data\nmay no longer fit in the temporary buffer used to rebuild the\nadvertising data.\n\nReject that case before copying the existing payload and report the\nfailure through the device log. This keeps the existing advertising\ndata intact and avoids overrunning the temporary buffer."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is reached through local AF_BLUETOOTH HCI management/ISO socket operations that configure advertising data and start BIS/periodic advertising. It is not reachable directly from Bluetooth radio packets sent by an adjacent attacker.\nAC:L - The attacker can choose the advertising payload length/content, omit an existing Broadcast Announcement, provide BASE data that creates Basic Audio Announcement periodic data, and trigger the prepend deterministically. The needed Bluetooth LE Audio/extended advertising support is a reasonable affected deployment condition.\nPR:L - The advertising setup path requires a trusted HCI management socket via CAP_NET_ADMIN, but the code uses capable() and is therefore reachable by a basic local user with CAP_NET_ADMIN obtained in a user namespace on systems allowing unprivileged user namespaces. ISO socket triggering itself has no stronger privilege gate.\nUI:N - No victim action is required once the local attacker can issue the Bluetooth socket operations. The attacker performs both setup and trigger steps directly.\nS:U - The corruption occurs in kernel Bluetooth code and affects the same kernel security authority. This is a standard local kernel memory-corruption scenario, not a VM/IOMMU or other cross-scope boundary escape.\nC:H - The bug is an attacker-controlled kernel stack out-of-bounds write, and such memory corruption can plausibly be leveraged beyond a simple crash in less hardened configurations. Under the required uncertainty rule, confidentiality impact is scored high.\nI:H - The vulnerable memcpy writes past a fixed 251-byte stack buffer with attacker-controlled advertising bytes. Out-of-bounds kernel writes are scored as high integrity impact because they may enable control-flow or data corruption.\nA:H - At minimum, the overflow can corrupt stack state or trigger hardening checks such as stack protector/FORTIFY, causing an oops or panic. The attacker can repeat the local trigger to deny service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:34:09.314Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/10b0e832cc05d7aef4b92bed912cbd4a395d0862"
        },
        {
          "url": "https://git.kernel.org/stable/c/1338ee049a8910ba6c9cee963920e978e6893c7d"
        },
        {
          "url": "https://git.kernel.org/stable/c/02f50e8bb69f9b22516163a09922f5537d3b12d1"
        },
        {
          "url": "https://git.kernel.org/stable/c/dafc9f57140e66a10945127aa7433c3d715dc253"
        },
        {
          "url": "https://git.kernel.org/stable/c/cdd8bbdbee763fdf5bf343e6f7d4e79347739f62"
        },
        {
          "url": "https://git.kernel.org/stable/c/5c65b96b549ea2dcfde497436bf9e048deb87758"
        }
      ],
      "title": "Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-53209",
    "datePublished": "2026-06-25T08:39:14.915Z",
    "dateReserved": "2026-06-09T07:44:35.391Z",
    "dateUpdated": "2026-08-05T12:34:09.314Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-JFWG-QVFJ-22X4

CVE-2026-53209 (GCVE-0-2026-53209)

Tags

Sightings

Nomenclature

Related by attack behaviour