CVE-2026-64407 in Linux
Summary
by MITRE • 07/25/2026
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3()
During the v3 firmware download the controller sends a v3_data_req with a 32 bit offset and a 16 bit len. nxp_recv_fw_req_v3() checks only the lower bound of the offset and then sends firmware from that offset.
nxpdev->fw_dnld_v3_offset = offset - nxpdev->fw_v3_offset_correction; serdev_device_write_buf(nxpdev->serdev, nxpdev->fw->data + nxpdev->fw_dnld_v3_offset, len);
Nothing checks that fw_dnld_v3_offset + len stays within nxpdev->fw->size, so a controller that asks for an offset or length past the firmware image makes the driver read past the end of nxpdev->fw->data and send that memory back over UART.
nxp_recv_fw_req_v1() already bounds the same write. Add the equivalent check to the v3 path, reject the request when it falls outside the firmware image, and zero len on the error path so the fw_v3_prev_sent bookkeeping at free_skb stays consistent.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/26/2026
This vulnerability exists in the Linux kernel's Bluetooth subsystem within the nxp_uart driver implementation where an out-of-bounds memory read occurs during firmware download operations. The issue specifically affects the v3 firmware download mechanism where the controller sends a v3_data_req packet containing a 32-bit offset and 16-bit length parameters. The driver function nxp_recv_fw_req_v3() processes these parameters but fails to validate that the calculated memory access remains within the bounds of the firmware image data structure.
The technical flaw stems from insufficient input validation where only the lower bound of the offset parameter is checked while the upper bound validation is completely missing. When a malicious or faulty controller sends an offset and length combination that extends beyond the firmware image boundaries, the driver calculates nxpdev->fw_dnld_v3_offset using the provided offset minus a correction factor, then proceeds to read from memory location nxpdev->fw->data + nxpdev->fw_dnld_v3_offset. This operation can result in reading arbitrary kernel memory past the end of the firmware data buffer and transmitting this sensitive data over the UART interface.
The operational impact of this vulnerability is significant as it allows for information disclosure attacks where an attacker could potentially extract kernel memory contents including sensitive data, cryptographic keys, or system configuration details through the Bluetooth UART interface. This represents a classic buffer overflow scenario that falls under CWE-129 Input Validation and CWE-787 Out-of-bounds Write categories. The vulnerability enables potential data exfiltration through the serial communication channel, which could be exploited in both local and remote attack scenarios depending on system configuration.
The fix involves implementing bounds checking similar to what already exists in the nxp_recv_fw_req_v1() function. This requires verifying that the calculated offset plus length does not exceed the firmware image size before proceeding with memory operations. When bounds validation fails, the request should be rejected with appropriate error handling that maintains consistency in the firmware download bookkeeping mechanisms. The solution aligns with ATT&CK technique T1059 Command and Scripting Interpreter and T1567 Exfiltration Over Web Service, as it addresses a fundamental memory safety issue that could enable data leakage through kernel memory access patterns. Proper bounds checking ensures that all firmware download operations remain within the allocated buffer boundaries while maintaining system stability and preventing unauthorized information disclosure through the Bluetooth UART communication path.
This vulnerability demonstrates the critical importance of input validation in kernel drivers where malformed data from external devices can lead to serious security implications. The fix implements defensive programming practices that prevent out-of-bounds memory access patterns, which is essential for maintaining kernel integrity and preventing potential escalation to privilege escalation attacks. The solution maintains compatibility with existing firmware download protocols while adding necessary safety checks that protect against malicious or corrupted firmware requests that could otherwise compromise system security through information disclosure channels.