In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3()… (CVE-2026-64407)
A vulnerability in the Linux kernel Bluetooth driver btnxpuart allows an out-of-bounds firmware read during the v3 firmware download process. The function nxp_recv_fw_req_v3() does not properly check that the requested offset and length stay within the firmware image bounds, potentially causing memory beyond the firmware data to be read and sent over UART. This issue has been fixed by adding boundary checks and rejecting invalid requests.
AI Analysis
Technical Summary
The Linux kernel Bluetooth btnxpuart driver contained a vulnerability (CVE-2026-64407) in the nxp_recv_fw_req_v3() function used during v3 firmware downloads. The function accepts a 32-bit offset and 16-bit length from the controller but only checks the lower bound of the offset. It then reads and sends firmware data starting at the calculated offset without verifying that the sum of offset and length remains within the firmware image size. This can lead to an out-of-bounds read of kernel memory and sending unintended data over UART. The fix adds boundary checks to reject requests that exceed the firmware image size and ensures consistent bookkeeping on error paths.
Potential Impact
An attacker controlling the Bluetooth controller could cause the driver to read and transmit memory beyond the intended firmware image. This may lead to leakage of kernel memory contents over UART. There is no indication of remote code execution or privilege escalation from this vulnerability based on the provided data.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to add proper boundary checks in nxp_recv_fw_req_v3() and reject out-of-bounds requests. Users should apply the updated Linux kernel version containing this patch once available. Patch status is not yet confirmed in the provided data; check the official Linux kernel advisories or vendor updates for the exact fixed versions and remediation instructions.
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3()… (CVE-2026-64407)
Description
A vulnerability in the Linux kernel Bluetooth driver btnxpuart allows an out-of-bounds firmware read during the v3 firmware download process. The function nxp_recv_fw_req_v3() does not properly check that the requested offset and length stay within the firmware image bounds, potentially causing memory beyond the firmware data to be read and sent over UART. This issue has been fixed by adding boundary checks and rejecting invalid requests.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel Bluetooth btnxpuart driver contained a vulnerability (CVE-2026-64407) in the nxp_recv_fw_req_v3() function used during v3 firmware downloads. The function accepts a 32-bit offset and 16-bit length from the controller but only checks the lower bound of the offset. It then reads and sends firmware data starting at the calculated offset without verifying that the sum of offset and length remains within the firmware image size. This can lead to an out-of-bounds read of kernel memory and sending unintended data over UART. The fix adds boundary checks to reject requests that exceed the firmware image size and ensures consistent bookkeeping on error paths.
Potential Impact
An attacker controlling the Bluetooth controller could cause the driver to read and transmit memory beyond the intended firmware image. This may lead to leakage of kernel memory contents over UART. There is no indication of remote code execution or privilege escalation from this vulnerability based on the provided data.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to add proper boundary checks in nxp_recv_fw_req_v3() and reject out-of-bounds requests. Users should apply the updated Linux kernel version containing this patch once available. Patch status is not yet confirmed in the provided data; check the official Linux kernel advisories or vendor updates for the exact fixed versions and remediation instructions.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-vpwp-65cp-hgqm
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-64407"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a65420a9c2644c7f8083ba6
Added to database: 07/25/2026, 23:08:58 UTC
Last enriched: 07/25/2026, 23:25:34 UTC
Last updated: 07/26/2026, 03:43:03 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.