CVE-2026-74300

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci: validate codec capability element length

Read Local Codec Capabilities returns a sequence of capability elements.

Each element starts with a one-byte length followed by that many payload

bytes.

hci_read_codec_capabilities() checks that the skb contains the length

byte, but then validates only caps->len against the remaining skb

length. A malformed controller response with one remaining byte and

caps->len set to one passes that check even though the element needs two

bytes. The parser then records a two-byte capability and copies one

byte beyond the advertised response payload into the codec list.

Validate the full element size, including the length byte, before adding

it to the accumulated capability length. This preserves all well-formed

capability elements and drops only truncated controller responses.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References