CVE-2026-53255 Bluetooth: MGMT: validate advertising TLV before type checks
A local attacker can trigger an out-of-bounds read in the Linux kernel Bluetooth subsystem via malformed advertising data, causing a crash or information leak.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-53255?
CVE-2026-53255 is a high-severity memory corruption vulnerability in Linux kernel, published on 25 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: MGMT: validate advertising TLV before type checks
tlv_data_is_valid() reads each advertising data field length from data[i], then inspects data[i + 1] for managed EIR types before checking that the current field still fits inside the supplied buffer.
A malformed field whose length byte is the last byte of the buffer can therefore make the parser read one byte past the advertising data.
KASAN reported the following when a malformed MGMT_OP_ADD_ADVERTISING request reached that path:
BUG: KASAN: vmalloc-out-of-bounds in tlv_data_is_valid() Read of size 1 Call trace: tlv_data_is_valid() add_advertising() hci_mgmt_cmd() hci_sock_sendmsg()
Move the existing element-length check before any type-octet inspection so each non-empty element is proven to contain its type byte before the parser looks at data[i + 1].
Weakness: CWE-125
Which versions are affected by CVE-2026-53255?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-53255?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-53255 being exploited?
There is no known exploitation of CVE-2026-53255 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-90680, BELL-CVE-2026-53255, DEBIAN-CVE-2026-53255, GHSA-hxxh-4jr7-w99w, ROOT-OS-DEBIAN-11-CVE-2026-53255, ROOT-OS-DEBIAN-12-CVE-2026-53255 and 3 more.