https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 05:41:50 +0000 https://vulnerability.circl.lu/vuln/cve-2026-53255 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>Bluetooth: MGMT: validate advertising TLV before type checks</p> <p>tlv_data_is_valid() reads each advertising data field length from data[i], then inspects data[i + 1] for managed EIR types before checking that the current field still fits inside the supplied buffer.</p> <p>A malformed field whose length byte is the last byte of the buffer can therefore make the parser read one byte past the advertising data.</p> <p>KASAN reported the following when a malformed MGMT_OP_ADD_ADVERTISING request reached that path:</p> <p>BUG: KASAN: vmalloc-out-of-bounds in tlv_data_is_valid() Read of size 1 Call trace: tlv_data_is_valid() add_advertising() hci_mgmt_cmd() hci_sock_sendmsg()</p> <p>Move the existing element-length check before any type-octet inspection so each non-empty element is proven to contain its type byte before the parser looks at data[i + 1].</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>Bluetooth: MGMT: validate advertising TLV before type checks</p> <p>tlv_data_is_valid() reads each advertising data field length from data[i], then inspects data[i + 1] for managed EIR types before checking that the current field still fits inside the supplied buffer.</p> <p>A malformed field whose length byte is the last byte of the buffer can therefore make the parser read one byte past the advertising data.</p> <p>KASAN reported the following when a malformed MGMT_OP_ADD_ADVERTISING request reached that path:</p> <p>BUG: KASAN: vmalloc-out-of-bounds in tlv_data_is_valid() Read of size 1 Call trace: tlv_data_is_valid() add_advertising() hci_mgmt_cmd() hci_sock_sendmsg()</p> <p>Move the existing element-length check before any type-octet inspection so each non-empty element is proven to contain its type byte before the parser looks at data[i + 1].</p> https://vulnerability.circl.lu/vuln/cve-2026-53255