The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup() bpa10x_setup() sends the vendor     command 0xfc0e and passes the response to bt_dev_info() and hci_set_fw_info() as a %s string starting at     skb->data + 1, without checking the length: bt_dev_info(hdev, %s, (char *)(skb->data + 1));
    hci_set_fw_info(hdev, %s, skb->data + 1); A device that returns a one-byte response (status only) leaves     skb->data + 1 past the end of the data, and the %s walk reads adjacent slab memory until it meets a NUL.
    The same happens when the payload is not NUL-terminated within skb->len. The out-of-bounds bytes end up in     the kernel log and the firmware-info debugfs file. Print the revision string with a bounded %.*s limited     to skb->len - 1 instead. This keeps the string readable for well-behaved devices while never reading past     the received data, and does not fail setup, so a device returning a short or unterminated response keeps     working. (CVE-2026-64549)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-64549

medium Nessus Plugin ID 330248

Version 1.5