@@ -76,6 +76,8 @@ SRC_URI = "${KERNELORG_MIRROR}/linux/bluetooth/bluez-${PV}.tar.xz \
file://0001-src-device-Fix-stored-gatt-cache-DB-Hash-value-no.patch \
file://0001-profile-Set-L2CAP-IMTU-for-OBEX-profile-listeners.patch \
file://0001-adapter-restrict-delta-0-RSSI-to-proximity-filters.patch \
+ file://CVE-2026-19774_p1.patch \
+ file://CVE-2026-19774_p2.patch \
"
S = "${UNPACKDIR}/bluez-${PV}"
new file mode 100644
@@ -0,0 +1,63 @@
+From d4b922a688f5cd50f31afd663835ff05f294a85b Mon Sep 17 00:00:00 2001
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Date: Mon, 15 Jun 2026 09:44:11 -0400
+Subject: [PATCH] a2dp: Fix handling of codec capability storage
+
+Codec capability is one byte long (max 255) the storage format is
+02hhx which means each byte ends up as 2 characters so the buffer
+needs to be doubled in order to handle capabilities of that size.
+
+CVE: CVE-2026-19774
+Upstream-Status: Backport [https://github.com/bluez/bluez/commit/912f5efb0dd9bb08e408d33371a57182c5678aef]
+
+Reported-by: p0her (_@p0her_) in TeamH4C working with TrendAI Zero Day Initiative
+Reported-by: Michael Bommarito <michael.bommarito@gmail.com>
+Signed-off-by: Ashishkumar Parmar <asparmar@cisco.com>
+---
+ profiles/audio/a2dp.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/profiles/audio/a2dp.c b/profiles/audio/a2dp.c
+index 7a37003a2..aec54728e 100644
+--- a/profiles/audio/a2dp.c
++++ b/profiles/audio/a2dp.c
+@@ -971,7 +971,7 @@ static void store_remote_sep(void *data, void *user_data)
+ {
+ struct a2dp_remote_sep *sep = data;
+ GKeyFile *key_file = user_data;
+- char seid[4], value[256];
++ char seid[4], value[9 + 512];
+ struct avdtp_service_capability *service = avdtp_get_codec(sep->sep);
+ struct avdtp_media_codec_capability *codec;
+ unsigned int i;
+@@ -2373,7 +2373,7 @@ static void load_remote_sep(struct a2dp_channel *chan, GKeyFile *key_file,
+ uint8_t codec;
+ uint8_t delay_reporting;
+ GSList *l = NULL;
+- char caps[256];
++ char caps[513];
+ uint8_t data[128];
+ int i, size;
+
+@@ -2386,10 +2386,10 @@ static void load_remote_sep(struct a2dp_channel *chan, GKeyFile *key_file,
+ continue;
+
+ /* Try loading with delay_reporting first */
+- if (sscanf(value, "%02hhx:%02hhx:%02hhx:%s", &type, &codec,
++ if (sscanf(value, "%02hhx:%02hhx:%02hhx:%512s", &type, &codec,
+ &delay_reporting, caps) != 4) {
+ /* Try old format */
+- if (sscanf(value, "%02hhx:%02hhx:%s", &type, &codec,
++ if (sscanf(value, "%02hhx:%02hhx:%512s", &type, &codec,
+ caps) != 3) {
+ warn("Unable to load Endpoint: seid %u", rseid);
+ g_free(value);
+@@ -2398,7 +2398,7 @@ static void load_remote_sep(struct a2dp_channel *chan, GKeyFile *key_file,
+ delay_reporting = false;
+ }
+
+- for (i = 0, size = strlen(caps); i < size; i += 2) {
++ for (i = 0, size = strlen(caps); i < size && i >= 2; i += 2) {
+ uint8_t *tmp = data + i / 2;
+
+ if (sscanf(caps + i, "%02hhx", tmp) != 1) {
new file mode 100644
@@ -0,0 +1,62 @@
+From 1bbcccb35c946e079074e64c217c81089442a568 Mon Sep 17 00:00:00 2001
+From: Mikhail Gavrilov <mikhail.v.gavrilov@gmail.com>
+Date: Fri, 10 Jul 2026 12:28:17 +0500
+Subject: [PATCH] a2dp: Fix loading of remote SEP from cache
+
+Commit 912f5efb0dd9 ("a2dp: Fix handling of codec capability storage")
+added an 'i >= 2' condition to the loop that parses the stored codec
+capabilities. Since i starts at 0 the loop body never runs, i stays 0,
+and the subsequent 'if (i != size)' check discards every endpoint found
+in the cache:
+
+ load_remote_sep() Unable to load LastUsed: rseid 6 not found
+
+With no remote SEP loaded, avdtp_discover() can no longer take the
+cached path and issues AVDTP Discover/Get All Capabilities on every
+reconnect, and a2dp_setup_remote_path() returns NULL so the transport
+ends up at /org/bluez/hciX/dev_YY/fd0 instead of .../sepN/fd0.
+
+The condition was presumably meant to bound the writes into data[128],
+which the original commit did not actually fix: caps is read with
+'%512s' so size / 2 can be up to 256. Validate size up front instead.
+
+CVE: CVE-2026-19774
+Upstream-Status: Backport [https://github.com/bluez/bluez/commit/b7d71e5067856b0daf2f1f73b3fc95483236610e]
+
+Fixes: https://github.com/bluez/bluez/issues/2285
+Signed-off-by: Ashishkumar Parmar <asparmar@cisco.com>
+---
+ profiles/audio/a2dp.c | 13 ++++++++++---
+ 1 file changed, 10 insertions(+), 3 deletions(-)
+
+diff --git a/profiles/audio/a2dp.c b/profiles/audio/a2dp.c
+index aec54728e..93cf11fe1 100644
+--- a/profiles/audio/a2dp.c
++++ b/profiles/audio/a2dp.c
+@@ -2398,7 +2398,16 @@ static void load_remote_sep(struct a2dp_channel *chan, GKeyFile *key_file,
+ delay_reporting = false;
+ }
+
+- for (i = 0, size = strlen(caps); i < size && i >= 2; i += 2) {
++ size = strlen(caps);
++
++ g_free(value);
++
++ if (size % 2 || size / 2 > (int) sizeof(data)) {
++ warn("Unable to load Endpoint: seid %u", rseid);
++ continue;
++ }
++
++ for (i = 0; i < size; i += 2) {
+ uint8_t *tmp = data + i / 2;
+
+ if (sscanf(caps + i, "%02hhx", tmp) != 1) {
+@@ -2407,8 +2416,6 @@ static void load_remote_sep(struct a2dp_channel *chan, GKeyFile *key_file,
+ }
+ }
+
+- g_free(value);
+-
+ if (i != size)
+ continue;
+