2025-12-08 00:46:17
Linux
PUBLISHED
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern() In the parse_adv_monitor_pattern() function, the value of the length variable is currently limited to HCI_MAX_EXT_AD_LENGTH(251). The size of the value array in the mgmt_adv_pattern structure is 31. If the value of pattern[i].length is set in the user space and exceeds 31, the patterns[i].value array can be accessed out of bound when copied. Increasing the size of the value array in the mgmt_adv_pattern structure will break the userspace. Considering this, and to avoid OOB access revert the limits for offset and length back to the value of HCI_MAX_AD_LENGTH. Found by InfoTeCS on behalf of Linux Verification Center (linuxtesting.org) with SVACE.