The Linux kernel Bluetooth L2CAP code had a vulnerability (CVE-2026-64403) where l2cap_get_conf_opt() used an attacker-controlled length field to read option values without first verifying that the buffer contained enough data. This caused up to 4 bytes to be read out-of-bounds before the callers detected the malformed option. The issue was fixed by passing the buffer end pointer into l2cap_get_conf_opt() and refusing to read option values unless the full option fits within the buffer, preventing out-of-bounds reads at the source.

The vulnerability results in an out-of-bounds read of up to 4 bytes in the Bluetooth L2CAP configuration option parsing. Although no data leak is currently observed due to a post-hoc length check, the bug represents a fragile validate-after-use condition that could lead to undefined behavior or potential security issues if the code is modified or exploited differently in the future.

A fix is available that properly validates the option length before reading the option value in the l2cap_get_conf_opt() function. Users should apply the official Linux kernel patch that introduces this validation. Since this is a kernel vulnerability, updating to a kernel version that includes this fix is recommended. No additional mitigation is indicated by the vendor advisory.