Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-64573— Bluetooth: qca: fix NVM tag length underflow in TLV parser

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会开源的一款操作系统内核。 Linux kernel存在安全漏洞，该漏洞源于NVM标签长度整数下溢，可能导致越界读取和写入。

AI Predicted 7.8 Difficulty: Moderate EPSS 0.16% · P5

Possible ATT&CK Techniques 1 AI

T1203 · Exploitation for Client Execution

Affected Version Matrix 21

VendorProduct Version RangeStatus
Linux Linux ed53949cc92e28aaa3463d246942bda1fbb7f307< a7ee11441d71ab036a705d110a415421f5a4a898 affected
1caceadfb50432dbf6d808796cb6c34ebb6d662c< 5d34e537755d2f9eba2d4e54d70126f987ef20b4 affected
427281f9498ed614f9aabc80e46ec077c487da6d< 70354dbb5f72d9a76da7b031de3cbaf6c7d8fc24 affected
2e4edfa1e2bd821a317e7d006517dcf2f3fac68d< 59fd2f075bca94f030c7c78e94878ea0803d7690 affected
2e4edfa1e2bd821a317e7d006517dcf2f3fac68d< a087ed960fce54e9302796229e9d545bbc9bcd4a affected
2e4edfa1e2bd821a317e7d006517dcf2f3fac68d< 4fcfb5b2c736785464ff9745f94c6726c5ee2d85 affected
2e4edfa1e2bd821a317e7d006517dcf2f3fac68d< c90164ca0f7036942ba088eb7ea8d3f6c2352020 affected
02f05ed44b71152d5e11d29be28aed91c0489b4e affected
… +13 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-64573

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Bluetooth: qca: fix NVM tag length underflow in TLV parser
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: qca: fix NVM tag length underflow in TLV parser In the TLV_TYPE_NVM branch of qca_tlv_check_data() the tag loop bound is "while (idx < length - sizeof(struct tlv_type_nvm))". "length" is a signed int from the firmware TLV header and sizeof(struct tlv_type_nvm) is a size_t (12), so "length" is converted to size_t and any firmware-supplied "length" < 12 makes the subtraction wrap to a huge value. The loop body then reads a 12-byte struct tlv_type_nvm past the end of the short vmalloc'd firmware buffer (and the EDL_TAG_ID_* handlers can write past it). Rewrite the bound as "idx + sizeof(struct tlv_type_nvm) <= length"; both operands are non-negative, so it no longer underflows and a "length" too small for one record correctly skips the loop. BUG: KASAN: vmalloc-out-of-bounds in qca_download_firmware.isra.0 (drivers/bluetooth/btqca.c:421) Read of size 2 at addr ffffc900000e5004 by task kworker/u9:0/52 Workqueue: hci0 hci_power_on Call Trace: ... kasan_report (mm/kasan/report.c:595) qca_download_firmware.isra.0 (drivers/bluetooth/btqca.c:421 drivers/bluetooth/btqca.c:617) qca_uart_setup (drivers/bluetooth/btqca.c:948) qca_setup (drivers/bluetooth/hci_qca.c:2029) hci_uart_setup (drivers/bluetooth/hci_ldisc.c:438) hci_dev_open_sync (net/bluetooth/hci_sync.c:5227) hci_power_on (net/bluetooth/hci_core.c:920) process_one_work (kernel/workqueue.c:3322) worker_thread (kernel/workqueue.c:3486) kthread (kernel/kthread.c:436) ret_from_fork (arch/x86/kernel/process.c:158) ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会开源的一款操作系统内核。 Linux kernel存在安全漏洞，该漏洞源于NVM标签长度整数下溢，可能导致越界读取和写入。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux ed53949cc92e28aaa3463d246942bda1fbb7f307 ~ a7ee11441d71ab036a705d110a415421f5a4a898 -
Linux Linux 6.9 -

II. Public POCs for CVE-2026-64573

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-64573

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-64573 (6)

Same Patch Batch · Linux · 2026-08-05 · 17 CVEs total

CVE-2026-64566 9.8 CRITICAL xfrm: iptfs: propagate SKBFL_SHARED_FRAG in iptfs_skb_add_frags()
CVE-2026-64578 8.2 HIGH ksmbd: validate compound request size before reading StructureSize2
CVE-2026-64567 7.8 HIGH btrfs: reject free space cache with more entries than pages
CVE-2026-64568 7.8 HIGH wifi: mac80211: fix unsol_bcast_probe_resp double free on alloc failure
CVE-2026-64570 7.8 HIGH wifi: mac80211: fix fils_discovery double free on alloc failure
CVE-2026-64574 7.8 HIGH wifi: mac80211: tear down new links on vif update error path
CVE-2026-64575 7.8 HIGH bpf: tcp: fix double sock release on batch realloc
CVE-2026-64580 7.8 HIGH xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst()
CVE-2026-64581 7.8 HIGH xfrm: fix sk_dst_cache double-free in xfrm_user_policy()
CVE-2026-64582 7.8 HIGH RDMA/rxe: Fix a use-after-free problem in rxe_mmap
CVE-2026-64577 7.5 HIGH gtp: check skb_pull_data() return in gtp1u_send_echo_resp()
CVE-2026-64576 7.1 HIGH nexthop: initialize extack in nh_res_bucket_migrate()
CVE-2026-64569 mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n
CVE-2026-64571 wifi: p54: validate RX frame length in p54_rx_eeprom_readback()
CVE-2026-64572 ipv4: fib: free fib_alias with kfree_rcu() on insert error path
CVE-2026-64579 xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-64573

No comments yet

Leave a comment