PatchaPalooza

CVE-2026-64549: Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup()

CVE-2026-64549 is a vulnerability in Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup(), rated Low by Microsoft, with a CVSS 3.1 base score of 2.1 (Low). An attacker can exploit it by an attacker with physical access, without any privileges and only if a user takes an action. Microsoft has not reported exploitation in the wild. The EPSS model estimates a 0.19% probability of exploitation activity in the next 30 days, higher than 8% of all scored vulnerabilities. Microsoft released the fix on 6 August 2026, outside Patch Tuesday. It affects 1 product in 1 product family (Open Source Software).

Key facts

CVE ID
CVE-2026-64549
Severity
Low CVSS 2.1
Microsoft severity
Low
Exploited in the wild
No
Publicly disclosed
No
EPSS
0.19% (percentile 8%)
CISA KEV
Not listed
Released
Last updated
Patch Tuesday
July 2026 Patch Tuesday
Product families
Open Source Software

CVSS score and vector

Microsoft scores CVE-2026-64549 at 2.1 (temporal 2.1) using CVSS 3.1. Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

MetricValue
Attack vectorPhysical
Attack complexityLow
Privileges requiredNone
User interactionRequired
ScopeUnchanged
Confidentiality impactLow
Integrity impactNone
Availability impactNone

Affected products (1)

Open Source Software

ProductSecurity updateTypeFixed buildRestart
azl3 kernel 6.6.144.1-1 on Azure Linux 3.0CBL-Mariner ReleasesSecurity Update6.6.145.2-1No

NIST NVD data

NVD status
Awaiting Analysis
Published to NVD
NVD last modified

References

Revision history

VersionDateDescription
1.0Information published.

Sources