Public bug reported:
[Impact]
bluetoothd cannot register any LE advertisement on Ubuntu 24.04.5 noble once the
kernel carries the MGMT Add Extended Advertising Data length validation
(upstream "Bluetooth: MGMT: validate Add Extended Advertising Data length",
Michael Bommarito, 2026-05-15). Every attempt fails with:
Failed to register advertisement: org.bluez.Error.Failed
BLE peripheral/advertising mode is completely broken: no GATT
peripheral, no BlueZ-based beacon. Central role and pairing are
unaffected.
Root cause is in BlueZ, not the kernel. In add_adv_params_callback()
(src/advertising.c:1367) the payload length for MGMT_OP_ADD_EXT_ADV_DATA is
computed from the wrong struct:
param_len = sizeof(struct mgmt_cp_add_advertising) + adv_data_len +
scan_rsp_len;
struct mgmt_cp_add_advertising is 11 bytes; struct mgmt_cp_add_ext_adv_data
is 3. BlueZ therefore declares a payload 8 bytes longer than the data it
actually supplies. Older kernels accepted the overlong command; the new
kernel check requires
struct_size(cp, data, cp->adv_data_len + cp->scan_rsp_len) == data_len
and rejects it with MGMT_STATUS_INVALID_PARAMS (0x0d).
The kernel check is a security fix (the old code trusted adv_data_len /
scan_rsp_len without verifying they fit in the command buffer, allowing an
out-of-bounds read whose bytes could be stored as scan response data and read
back via MGMT_OP_GET_ADV_INSTANCE). It will not be reverted, so BlueZ must be
corrected.
Fixed upstream by commit 2a6968b40378 ("advertising: Fix sending extra bytes
with MGMT_OP_ADD_EXT_ADV_DATA", Luiz Augusto von Dentz, 2026-06-02), released
in BlueZ 5.87. Ubuntu's development series already carries 5.87-3. Noble is
still on 5.72 and is unfixed in both 5.72-0ubuntu5 and 5.72-0ubuntu5.5 --
no patch in debian/patches/series touches advertising.c or param_len.
[Test Plan]
for f in events/kprobes/*/enable; do [ -e "$f" ] && echo 0 > "$f"; done
echo > kprobe_events
echo "p:extdata add_ext_adv_data dlen=%x3:u16 advlen=+1(%x2):u8
srlen=+2(%x2):u8" >> kprobe_events
echo "p:mgmtstat mgmt_cmd_status status=%x3:u8" >> kprobe_events
echo 1 > events/kprobes/extdata/enable
echo 1 > events/kprobes/mgmtstat/enable
echo 1 > tracing_on
echo > trace'
timeout 5 bluetoothctl advertise on
sudo grep -E "extdata|mgmtstat" /sys/kernel/debug/tracing/trace
Log on Ubuntu 24.04.5 kernel 6.8.0-1064-raspi, bluez 5.72-ubuntu5.5:
Failed to register advertisement: org.bluez.Error.Failed
bluetoothd-705 [003] d.... 51.731707: extdata:
(add_ext_adv_data+0x0/0x3e0 [bluetooth]) dlen=14 advlen=3 srlen=0
bluetoothd-705 [003] d.... 51.731712: mgmtstat:
(mgmt_cmd_status+0x0/0x1c8 [bluetooth]) status=13
Log on Ubuntu 24.04.5 kernel 6.8.0-1048-raspi, bluez 5.72-ubuntu5.5
[CHG] Controller 2C:CF:67:B0:D8:89 SupportedInstances: 0x04 (4)
[CHG] Controller 2C:CF:67:B0:D8:89 ActiveInstances: 0x01 (1)
Advertising object registered
Tx Power: off
Name: off
Appearance: off
Discoverable: on
RSI: on
bluetoothd-704 [000] d.... 3120.892197: extdata:
(add_ext_adv_data+0x0/0x390 [bluetooth]) dlen=14 advlen=3 srlen=0
[Where problems could occur]
The change is one line and only affects the size passed to malloc0() and
mgmt_send() for MGMT_OP_ADD_EXT_ADV_DATA. It makes the buffer smaller by
exactly 8 bytes and makes the declared length match the data actually
written, so it cannot truncate advertising or scan response content.
The identical expression at src/advertising.c:920 is in refresh_legacy_adv()
for MGMT_OP_ADD_ADVERTISING, where mgmt_cp_add_advertising IS the correct
struct; upstream deliberately left it unchanged and this SRU does the same.
Risk is confined to LE advertising registration, which is currently 100%
broken on affected kernels, so regression potential is minimal. Worst case
would be a kernel that requires the oversized form -- no such kernel exists;
the old kernels accept both lengths, which is why the corrected length works
on every kernel version.
[Other Info]
Reproduced on Raspberry Pi 5, Ubuntu 24.04.5 noble, bluez 5.72-0ubuntu5.5 and
bluez 5.72-0ubuntu5,
linux-raspi 6.8.0-1064-raspi. Confirmed working again on 6.8.0-1048-raspi
with the same unpatched bluez, placing the kernel change between -1049 and
-1064.
The kernel patch is in generic net/bluetooth/mgmt.c, so any Ubuntu kernel
flavour carrying it is affected, not only linux-raspi.
Upstream fix: https://github.com/bluez/bluez/commit/2a6968b40378
** Affects: bluez (Ubuntu)
Importance: Undecided
Status: New
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2167855
Title:
bluetoothd sends oversized MGMT_OP_ADD_EXT_ADV_DATA; all BLE
advertising fails on kernels with the length check
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/bluez/+bug/2167855/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
