CVE-2026-53209 Details
Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend Existing advertising instances can already hold the maximum extended advertising payload. When hci_adv_bcast_annoucement() prepends the Broadcast Announcement service data to that payload, the combined data may no longer fit in the temporary buffer used to rebuild the advertising data. Reject that case before copying the existing payload and report the failure through the device log. This keeps the existing advertising data intact and avoids overrunning the temporary buffer.
A vulnerability in the Linux kernel's Bluetooth implementation has been addressed. The issue arose in the handling of Broadcast Announcement service data within advertising instances that were already at maximum capacity. When the system attempted to prepend additional service data, it could exceed the limits of a temporary buffer used for reconstructing advertising data. This oversight risked overwriting existing data and creating a buffer overflow. The vulnerability has been fixed by implementing a check to prevent such an overflow, ensuring that the advertising data remains intact and any errors are logged appropriately.
Users can upgrade to the latest version of the Linux kernel where this vulnerability has been fixed. Instructions for downloading the patched version are available on the official Linux kernel website.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/02f50e8bb69f9b22516163a09922f5537d3b12d1 | kernel.org | Patch |
| https://git.kernel.org/stable/c/10b0e832cc05d7aef4b92bed912cbd4a395d0862 | kernel.org | Patch |
| https://git.kernel.org/stable/c/1338ee049a8910ba6c9cee963920e978e6893c7d | kernel.org | Patch |
| https://git.kernel.org/stable/c/5c65b96b549ea2dcfde497436bf9e048deb87758 | kernel.org | Patch |
| https://git.kernel.org/stable/c/cdd8bbdbee763fdf5bf343e6f7d4e79347739f62 | kernel.org | Patch |
| https://git.kernel.org/stable/c/dafc9f57140e66a10945127aa7433c3d715dc253 | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-787 | Out-of-bounds Write | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 6.1.142, < 6.1.176 >= 6.6.94, < 6.6.143 >= 6.12.34, < 6.12.94 >= 6.15.3, < 6.16 >= 6.16.1, < 6.18.36 >= 6.19, < 7.0.13 6.16 - 6.16 rc2 6.16 rc3 6.16 rc4 6.16 rc5 6.16 rc6 6.16 rc7 7.1 rc1 7.1 rc2 7.1 rc3 7.1 rc4 7.1 rc5 7.1 rc6 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 2, 2026 | Initial Analysis | [email protected] |
| Jun 28, 2026 | CVE Modified | kernel.org |
| Jun 25, 2026 | New CVE Received | kernel.org |