CVE-2026-80760

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: MGMT: reject HCI_CMD_SYNC params_len above 255

mgmt_hci_cmd_sync() checks that the message length agrees with params_len

but puts no upper bound on it. params_len is __le16 while the parameter

length in the HCI command header is a u8:

struct hci_command_hdr {

__le16 opcode;

__u8 plen;

} __packed;

hci_cmd_sync_alloc() assigns one to the other:

hdr->plen = plen;

if (plen)

skb_put_data(skb, param, plen);

so a params_len of 256 leaves plen at 0 while all 256 bytes are still

appended. The frame handed to the driver then declares no parameters and

carries 256 of them. On a length framed transport such as H:4 the

controller takes the trailing bytes as the start of the next packet.

The mgmt socket MTU is HCI_MAX_FRAME_SIZE, so params_len can reach about

1KB this way. Commit 03f1700b9b4d ("Bluetooth: MGMT: reject malformed

HCI_CMD_SYNC commands") only made params_len agree with the message

length, a

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References