CVE-2026-53255: Linux Kernel Bluetooth MGMT Buffer Over-Read Vulnerability

Technical summary

CVE-2026-53255 is a buffer over-read vulnerability in the Linux kernel's Bluetooth MGMT subsystem, specifically in the tlv_data_is_valid() function. The function parses advertising data fields by reading a length byte from data[i], then immediately inspects data[i+1] to check for managed EIR types before validating that the field length fits within the supplied buffer. When a malformed advertising data element has its length byte as the last byte of the buffer, the parser will read one byte past the end of the buffer during the type-octet inspection. The fix reorders validation logic to check element length bounds before accessing the type byte, ensuring no out-of-bounds reads occur. KASAN heap memory debugging tools detected this issue when a malformed MGMT_OP_ADD_ADVERTISING request triggered the vulnerable code path.

Business impact

An attacker with local system access can exploit this vulnerability to cause a kernel panic or system hang via a crafted Bluetooth management command, resulting in denial of service. The out-of-bounds read may also leak sensitive kernel memory contents to userspace processes, potentially exposing cryptographic keys, session tokens, or other protected data. Systems using Bluetooth management features are at elevated risk, particularly in multi-tenant or shared-access environments where local privilege escalation is a concern.

Affected systems

The Linux kernel across all maintained versions is affected. The vulnerability exists in the Bluetooth MGMT management interface which handles advertising data validation. Any system running the Linux kernel with Bluetooth subsystem enabled is potentially vulnerable. Distributions and vendors shipping affected kernel versions prior to the fix being applied are impacted.

Exploitability

Exploitation requires local access to the target system and the ability to send Bluetooth management socket commands, which typically requires the CAP_NET_ADMIN capability or userspace Bluetooth daemon interaction. The attack is straightforward—crafting a MGMT_OP_ADD_ADVERTISING request with a malformed TLV (tag-length-value) advertising data field is sufficient to trigger the out-of-bounds read. No user interaction or special conditions are required once the attacker has local code execution. The vulnerability does not appear on the CISA Known Exploited Vulnerabilities list at this time, though the simplicity of triggering the condition suggests rapid exploitation tooling could emerge.

Remediation

Apply the kernel patch that reorders validation checks in tlv_data_is_valid() to perform bounds checking before accessing field type octets. Verify against the vendor advisory for the specific fixed kernel version for your distribution. As an interim mitigation, restrict Bluetooth management command access via AppArmor, SELinux, or capability filtering if Bluetooth features are not required in production environments.

Patch guidance

Identify your Linux distribution and kernel branch, then upgrade to the patched kernel version provided by your vendor. The fix involves moving the element-length check before type-octet inspection in the Bluetooth MGMT validation path. Verify the vendor advisory for exact version numbers, as patch delivery varies by distribution. Test kernel updates in staging environments before production rollout. Monitor kernel changelogs and security advisories for your specific distribution to ensure timely application.

Detection guidance

Monitor kernel logs for KASAN reports or "vmalloc-out-of-bounds" messages from the Bluetooth MGMT subsystem. Enable audit logging on Bluetooth management sockets if your kernel supports it. Watch for unexpected kernel panics or hangs on systems with active Bluetooth management activity. Network intrusion detection is unlikely to be effective since the attack occurs over local Bluetooth management interfaces, but host-based monitoring for abnormal Bluetooth daemon behavior or repeated MGMT command failures may provide early warning.

Why prioritize this

Although the vulnerability requires local access and specific Bluetooth capabilities, the combination of high confidentiality impact (memory disclosure), high availability impact (denial of service), and ease of exploitation merits prompt patching. Systems in cloud environments, containers, or shared-access scenarios face elevated risk. The CVSS 7.1 HIGH severity rating reflects the realistic threat landscape for local attackers with moderate privilege levels.

Risk score, explained

CVSS 3.1 score of 7.1 (HIGH) is derived from: Attack Vector Local (requires local system access), Attack Complexity Low (straightforward malformed TLV crafting), Privileges Required Low (CAP_NET_ADMIN or Bluetooth daemon interaction), User Interaction None, Scope Unchanged, Confidentiality High (kernel memory leak potential), Integrity None, and Availability High (denial of service via panic). The score appropriately captures the seriousness of memory leakage combined with crash potential, moderated by the local-access requirement.

Frequently asked questions