Cloudanix VulnDB

CVE-2026-89583

High · 8.1

CVSS

8.1

EPSS

0.3%

Published

Sep 11, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in how Linux handles certain Bluetooth messages can let a nearby device read parts of the computer's internal memory that should stay private.

Exploitation
Adjacent Network
Attacker needs
None
Complexity
Low
Impact
Data Exposure
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Out-of-bounds read in Linux kernel Bluetooth EIR parsing allows an attacker-controlled periodic advertising payload to advance a pointer past the end of hcon->le_per_adv_data[] into adjacent kernel structures, exposing arbitrary bytes via getsockopt(BT_ISO_BASE) on an ISO socket.

Why it matters to the business

Remote attackers within Bluetooth range can read kernel memory belonging to active connections, potentially disclosing encryption material, device state, or other sensitive data without authentication, increasing risk of further compromise on systems handling Bluetooth audio or ISO broadcasts.

How an attack unfolds

An attacker broadcasts crafted periodic advertising reports containing multiple mismatched Service Data fields that cause cumulative eir_len drift. When the victim ISO broadcast sink processes these reports, eir_get_service_data() walks off the end of the advertising buffer. A final field matching the BAA UUID places attacker-chosen bytes into iso_pi(sk)->base where user-space reads them back.

How to fix it

Update the Linux kernel to a version containing the fix that recomputes eir_len from the buffer end on every iteration of eir_get_service_data(). Apply the patch referenced in the CVE or upgrade to a distribution kernel that includes the corrected Bluetooth EIR handling.

How to confirm the fix worked

Confirm the presence of the upstream commit that changes eir_get_service_data() to recompute remaining length from the buffer end each loop; test with a Bluetooth analyzer generating malformed Service Data fields and verify no out-of-bounds access occurs and that getsockopt returns only valid data.

Typical attack path

  1. Position a Bluetooth transmitter within range of the target device
  2. Transmit periodic advertising reports containing a sequence of Service Data fields sized to induce pointer drift
  3. Trigger ISO broadcast sink processing on the victim that calls eir_get_service_data() on the malformed payload
  4. Use getsockopt(BT_ISO_BASE) on a local ISO socket to retrieve the leaked kernel bytes

How to detect it

Look for unusual Bluetooth periodic advertising reports with many Service Data fields in kernel or userspace Bluetooth stack logs; inspect for processes calling getsockopt with BT_ISO_BASE on ISO sockets immediately after receiving advertising data; correlate with kernel oops or KASAN reports referencing eir_get_service_data or hci_conn structures.

What your security team should do

  • Prioritize kernel updates on any system exposing Bluetooth ISO or periodic advertising reception
  • Disable Bluetooth or ISO broadcast features where not required until patches are applied
  • Monitor vendor advisories for backported fixes in LTS kernels

The record

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: eir: Fix OOB read in eir_get_service_data() eir_get_service_data() walks the advertising data for a Service Data field with a matching UUID. On a mismatch it advances: eir += dlen; eir_len -= dlen; eir_get_data() reports dlen as the field's data length, but the field spans dlen + 2 bytes once its length and type bytes count, and more when non-Service-Data fields were skipped to reach it. The pointer lands correctly on the next field. eir_len does not, and the shortfall compounds across fields until eir_get_data() reads the length and type bytes of a "field" past the end of the buffer. For an ISO broadcast sink that buffer is hcon->le_per_adv_data[], filled from the periodic advertising reports of a remote broadcaster. A PA payload packed with mismatching Service Data fields walks off the array into the rest of struct hci_conn. A drifted field that matches the BAA UUID puts those bytes in iso_pi(sk)->base, where user space reads them back with getsockopt(BT_ISO_BASE). Recompute eir_len from the end of the buffer each iteration.

Affected packages

Ecosystem Package Introduced Fixed