CVE-2026-64549: Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup()

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup()

bpa10x_setup() sends the vendor command 0xfc0e and passes the response
to bt_dev_info() and hci_set_fw_info() as a "%s" string starting at
skb->data + 1, without checking the length:

	bt_dev_info(hdev, "%s", (char *)(skb->data + 1));
	hci_set_fw_info(hdev, "%s", skb->data + 1);

A device that returns a one-byte response (status only) leaves
skb->data + 1 past the end of the data, and the %s walk reads adjacent
slab memory until it meets a NUL. The same happens when the payload is
not NUL-terminated within skb->len. The out-of-bounds bytes end up in
the kernel log and the firmware-info debugfs file.

Print the revision string with a bounded "%.*s" limited to skb->len - 1
instead. This keeps the string readable for well-behaved devices while
never reading past the received data, and does not fail setup, so a
device returning a short or unterminated response keeps working.

The Linux kernel CVE team has assigned CVE-2026-64549 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 4.4 with commit ddd68ec8f4847b460c9f580076eafe13b031a6fd and fixed in 5.10.261 with commit 1813add71e386f77b3040e6c8dc9b7b3ff965a6c
	Issue introduced in 4.4 with commit ddd68ec8f4847b460c9f580076eafe13b031a6fd and fixed in 5.15.212 with commit bd56c23f1f8681a2857ee924a8bd3abf87c8913b
	Issue introduced in 4.4 with commit ddd68ec8f4847b460c9f580076eafe13b031a6fd and fixed in 6.1.178 with commit 7a64f39ebe1bacd9004a62eceadac0b122ec3cc2
	Issue introduced in 4.4 with commit ddd68ec8f4847b460c9f580076eafe13b031a6fd and fixed in 6.6.145 with commit f80b4afe893dffa9fabdbf80fb4d6782b24a6793
	Issue introduced in 4.4 with commit ddd68ec8f4847b460c9f580076eafe13b031a6fd and fixed in 6.12.97 with commit 4b4008dda1d0c6e598d7865631ad4eda63a560f0
	Issue introduced in 4.4 with commit ddd68ec8f4847b460c9f580076eafe13b031a6fd and fixed in 6.18.40 with commit bfc9e7be289df11e8e38c98cd78019d67fdd0bd5
	Issue introduced in 4.4 with commit ddd68ec8f4847b460c9f580076eafe13b031a6fd and fixed in 7.1.5 with commit a8e169d308775039200bb9c905c7ce420db6e8c5
	Issue introduced in 4.4 with commit ddd68ec8f4847b460c9f580076eafe13b031a6fd and fixed in 7.2-rc3 with commit dd068ef044128db655f48323a4acfd5907e04903

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64549
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/bluetooth/bpa10x.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/1813add71e386f77b3040e6c8dc9b7b3ff965a6c
	https://git.kernel.org/stable/c/bd56c23f1f8681a2857ee924a8bd3abf87c8913b
	https://git.kernel.org/stable/c/7a64f39ebe1bacd9004a62eceadac0b122ec3cc2
	https://git.kernel.org/stable/c/f80b4afe893dffa9fabdbf80fb4d6782b24a6793
	https://git.kernel.org/stable/c/4b4008dda1d0c6e598d7865631ad4eda63a560f0
	https://git.kernel.org/stable/c/bfc9e7be289df11e8e38c98cd78019d67fdd0bd5
	https://git.kernel.org/stable/c/a8e169d308775039200bb9c905c7ce420db6e8c5
	https://git.kernel.org/stable/c/dd068ef044128db655f48323a4acfd5907e04903