SB20260912204 - Out-of-bounds read in Linux kernel bluetooth

Description

This security bulletin contains information about 1 vulnerability.

1) Out-of-bounds read (CVE-ID: CVE-2026-89583)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in eir_get_service_data() when processing periodic advertising data containing mismatching Service Data fields. A remote attacker can transmit a crafted periodic advertising payload to disclose sensitive information.

Exploitation requires an ISO broadcast sink to process periodic advertising reports from a remote broadcaster.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/4beb198bc59b242404a47c21990bc84165052c8a
• https://git.kernel.org/stable/c/815fc98c227a78cbd93d4c29f2833705b7c2bc0f
• https://git.kernel.org/stable/c/bb56e97bd67614238c1c0a4084704ccadbb875b4
• https://git.kernel.org/stable/c/c21fa79301d7d6ac0a4ec6c51e8ba10beaa08c50