CVE-2026-53209

Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend

State: Published
Severity: 7.8 High
Published: Jun 25, 2026
Updated: Oct 19, 2026
Reserved: Jun 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend

Existing advertising instances can already hold the maximum extended advertising payload. When hci_adv_bcast_annoucement() prepends the Broadcast Announcement service data to that payload, the combined data may no longer fit in the temporary buffer used to rebuild the advertising data.

Reject that case before copying the existing payload and report the failure through the device log. This keeps the existing advertising data intact and avoids overrunning the temporary buffer.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

CWE-122 Heap-based Buffer Overflow

Affected Products

Product	Versions
LinuxLinux	63f365eb4d1668a04070151b555d55a07ede8d4b to before 10b0e832cc05d7aef4b92bed912cbd4a395d0862Affected c621211b308816889f0a3246de448bfcef8ab3ab to before 1338ee049a8910ba6c9cee963920e978e6893c7dAffected 907ef6e12fb558a0763e894311eb245a94c192dd to before 02f50e8bb69f9b22516163a09922f5537d3b12d1Affected 5725bc608252050ed8a4d47d59225b7dd73474c8 to before dafc9f57140e66a10945127aa7433c3d715dc253Affected 5725bc608252050ed8a4d47d59225b7dd73474c8 to before cdd8bbdbee763fdf5bf343e6f7d4e79347739f62Affected 5725bc608252050ed8a4d47d59225b7dd73474c8 to before 5c65b96b549ea2dcfde497436bf9e048deb87758Affected 15da883c010cbc2a84aec1738b6ad6ee477846deAffected 6.1.142 to before 6.1.176Affected 6.6.94 to before 6.6.143Affected 6.12.34 to before 6.12.94Affected 6.15.3 to before 6.16Affected
LinuxLinux	6.16Affected before 6.16Not affected 6.1.176 through 6.1.Not affected 6.6.143 through 6.6.Not affected 6.12.94 through 6.12.Not affected 6.18.36 through 6.18.Not affected 7.0.13 through 7.0.*Not affected 7.1 and laterNot affected

Product

Versions

LinuxLinux

63f365eb4d1668a04070151b555d55a07ede8d4b to before 10b0e832cc05d7aef4b92bed912cbd4a395d0862Affected
c621211b308816889f0a3246de448bfcef8ab3ab to before 1338ee049a8910ba6c9cee963920e978e6893c7dAffected
907ef6e12fb558a0763e894311eb245a94c192dd to before 02f50e8bb69f9b22516163a09922f5537d3b12d1Affected
5725bc608252050ed8a4d47d59225b7dd73474c8 to before dafc9f57140e66a10945127aa7433c3d715dc253Affected
5725bc608252050ed8a4d47d59225b7dd73474c8 to before cdd8bbdbee763fdf5bf343e6f7d4e79347739f62Affected
5725bc608252050ed8a4d47d59225b7dd73474c8 to before 5c65b96b549ea2dcfde497436bf9e048deb87758Affected
15da883c010cbc2a84aec1738b6ad6ee477846deAffected
6.1.142 to before 6.1.176Affected
6.6.94 to before 6.6.143Affected
6.12.34 to before 6.12.94Affected
6.15.3 to before 6.16Affected

LinuxLinux

6.16Affected
before 6.16Not affected
6.1.176 through 6.1.*Not affected
6.6.143 through 6.6.*Not affected
6.12.94 through 6.12.*Not affected
6.18.36 through 6.18.*Not affected
7.0.13 through 7.0.*Not affected
7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.