CVE-2024-26889

MEDIUM

Linux Kernel 4.14.328-4.15 - Buffer Overflow in Bluetooth HCI Core Name Field

Title source: llm
STIX 2.1

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: Fix possible buffer overflow struct hci_dev_info has a fixed size name[8] field so in the event that hdev->name is bigger than that strcpy would attempt to write past its size, so this fixes this problem by switching to use strscpy.

References (12)

Core 12
Core References

Scores

CVSS v3 5.5
EPSS 0.0027
EPSS Percentile 18.8%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-120
Status published
Products (37)
debian/debian_linux 10.0
linux/Kernel < 4.19.311linux
linux/Kernel 4.20.0 - 5.4.273linux
linux/Kernel 5.11.0 - 5.15.153linux
linux/Kernel 5.16.0 - 6.6.23linux
linux/Kernel 5.5.0 - 5.10.214linux
linux/Kernel 6.6.0 - 6.7.11linux
linux/Kernel 6.7.0 - 6.8.2linux
Linux/Linux < 6.6
Linux/Linux 194ab82c1ea187512ff2f822124bd05b63fc9f76 - 6d5a9d4a7bcbb7534ce45a18a52e7bd23e69d8ac
... and 27 more
Published Apr 17, 2024
Tracked Since Feb 18, 2026