CVE-2026-64403

CVE-2026-64403 is a bounds-checking failure in the Linux kernel's Bluetooth L2CAP configuration parsing. The function l2cap_get_conf_opt() receives a pointer to configuration options and extracts values by reading opt->len to determine how many bytes to read from opt->val. The problem: opt->len is attacker-controlled from incoming Bluetooth protocol data, and the function dereferences opt->val using that length before validating whether sufficient data exists in the buffer. The function returns successfully, producing up to 4 bytes of out-of-bounds data that callers then consume. A post-hoc negative-length check detects corruption after the fact — but only returns an error code that callers must interpret through understanding the function's internal implementation. This leaves every caller in the position of needing to reverse-engineer the failure mode. Three callers are affected: l2cap_parse_conf_req(), l2cap_parse_conf_rsp(), and l2cap_conf_rfc_get(). The fix restructures the API contract: callers now pass an end boundary pointer, and the function returns a clean boolean indicating success or failure before performing any dereference. This shifts from 'here's a pointer, trust the length, detect corruption later' to 'here's a pointer and a boundary; extraction refuses to proceed without sufficient data.' This vulnerability is not an isolated mistake. The L2CAP parsing layer exhibits a recurring genotype: functions that assume kernel-internal protocol fields are pre-validated because they originate from within the Bluetooth stack rather than from remote devices. The same structural pattern — premature dereference of attacker-controlled length fields — appears in HCI event parsing, SCO payload handling, and ATT PDU extraction. The original threat model treated these as internal APIs operating on trusted data; modern Bluetooth attack surfaces have invalidated that assumption. You should audit other L2CAP parsing functions that process remote input for similar validate-after-use patterns, particularly where length fields flow from the wire into pointer arithmetic without upfront bounds verification. The fix pattern (end pointers, clean boolean returns) should become the canonical contract for any new parsing functions in this subsystem.

Reviewed through automated stages and approved by a human before publication.