CVE-2026-64407Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3()
- 7.1HighCVSS base score
- 0.13%Exploitation in 30 daysEPSS · top 98% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3() During the v3 firmware download the controller sends a v3_data_req with a 32 bit offset and a 16 bit len. nxp_recv_fw_req_v3() checks only the lower bound of the offset and then sends firmware from that offset. nxpdev->fw_dnld_v3_offset = offset - nxpdev->fw_v3_offset_correction; serdev_device_write_buf(nxpdev->serdev, nxpdev->fw->data + nxpdev->fw_dnld_v3_offset, len); Nothing checks that fw_dnld_v3_offset + len stays within nxpdev->fw->size, so a controller that asks for an offset or length past the firmware image makes the driver read past the end of nxpdev->fw->data and send that memory back over UART. nxp_recv_fw_req_v1() already bounds the same write. Add the equivalent check to the v3 path, reject the request when it falls outside the firmware image, and zero len on the error path so the fw_v3_prev_sent bookkeeping at free_skb stays consistent.
Timeline
ID reserved
By Linux
- 6 days later
· 6 days later
Published
- 23 days later
· 23 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Analyzed | 3.1 | High7.1 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H |
- EPSS (exploitation in 30 days)
- 0.13% · top 98% of all CVEs (13 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.1.
Affected products
- affected 689ca16e523278470c38832a3010645a78c544d8 – < 21e60eb4d95854196e7c0e77383f35e7ac95df61
- affected 689ca16e523278470c38832a3010645a78c544d8 – < 441088792ffec3ca01f4efe2934060570eb11eb8
- affected 689ca16e523278470c38832a3010645a78c544d8 – < 2a68a773089204af1c8581dc79668b775418c5ee
- affected 689ca16e523278470c38832a3010645a78c544d8 – < 49bcb39e3a041ce26021f77971eaccb49a275118
- affected 689ca16e523278470c38832a3010645a78c544d8 – < badff6c3bed8923a1257a853f137d447976eec30
- affected 6.4
- unaffected < 6.4
- unaffected 6.6.145 – ≤ 6.6.*
- unaffected 6.12.96 – ≤ 6.12.*
- unaffected 6.18.39 – ≤ 6.18.*
- unaffected 7.1.4 – ≤ 7.1.*
- unaffected 7.2 – ≤ *
References
References5
- https://git.kernel.org/stable/c/21e60eb4d95854196e7c0e77383f35e7ac95df61 (opens in a new tab)
- https://git.kernel.org/stable/c/441088792ffec3ca01f4efe2934060570eb11eb8 (opens in a new tab)
- https://git.kernel.org/stable/c/2a68a773089204af1c8581dc79668b775418c5ee (opens in a new tab)
- https://git.kernel.org/stable/c/49bcb39e3a041ce26021f77971eaccb49a275118 (opens in a new tab)
- https://git.kernel.org/stable/c/badff6c3bed8923a1257a853f137d447976eec30 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-48951 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-64407)Record last updated .