{"cve":"CVE-2026-64549","nvd":{"published":"2026-07-27T21:17:07.720","modified":"2026-08-17T05:18:00.267","status":"Received","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup()\n\nbpa10x_setup() sends the vendor command 0xfc0e and passes the response\nto bt_dev_info() and hci_set_fw_info() as a \"%s\" string starting at\nskb->data + 1, without checking the length:\n\n\tbt_dev_info(hdev, \"%s\", (char *)(skb->data + 1));\n\thci_set_fw_info(hdev, \"%s\", skb->data + 1);\n\nA device that returns a one-byte response (status only) leaves\nskb->data + 1 past the end of the data, and the %s walk reads adjacent\nslab memory until it meets a NUL. The same happens when the payload is\nnot NUL-terminated within skb->len. The out-of-bounds bytes end up in\nthe kernel log and the firmware-info debugfs file.\n\nPrint the revision string with a bounded \"%.*s\" limited to skb->len - 1\ninstead. This keeps the string readable for well-behaved devices while\nnever reading past the received data, and does not fail setup, so a\ndevice returning a short or unterminated response keeps working.","cvss_v4":null,"cvss_v3":null,"cwes":[],"references":["https://git.kernel.org/stable/c/1813add71e386f77b3040e6c8dc9b7b3ff965a6c","https://git.kernel.org/stable/c/4b4008dda1d0c6e598d7865631ad4eda63a560f0","https://git.kernel.org/stable/c/7a64f39ebe1bacd9004a62eceadac0b122ec3cc2","https://git.kernel.org/stable/c/a8e169d308775039200bb9c905c7ce420db6e8c5","https://git.kernel.org/stable/c/bd56c23f1f8681a2857ee924a8bd3abf87c8913b"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:46:40.600842820+00:00"},"epss":{"cve":"CVE-2026-64549","score":0.0018,"percentile":0.07613,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}