The Linux kernel Bluetooth vulnerability (CVE-2026-89583) involves an out-of-bounds read in the eir_get_service_data() function, which parses Service Data fields in advertising data. The function advances pointers based on a data length (dlen) that excludes length and type bytes, causing the buffer length counter (eir_len) to underflow. This results in reading past the buffer boundary into adjacent kernel memory structures. Specifically, for ISO broadcast sinks, this can leak memory from struct hci_conn into user space via the BT_ISO_BASE socket option. The fix involves recomputing eir_len from the buffer's end each iteration to prevent this drift.

This vulnerability allows an out-of-bounds read of kernel memory in the Bluetooth stack, potentially exposing sensitive kernel data to user space processes. It does not describe code execution or privilege escalation but could lead to information disclosure through the BT_ISO_BASE socket option. No known exploits are reported in the wild.

The vulnerability has been resolved in the Linux kernel by correcting the buffer length calculation in eir_get_service_data(). Users should apply the official Linux kernel updates that include this fix. Since no vendor advisory or patch links are provided, check the Linux kernel mailing lists or official repositories for the relevant patch. No additional mitigations are indicated.