CVE-2026-80759

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.5-1.1

Description An issue exists in the Bluetooth hci aml driver where the aml download firmware() function reads two lengths from the firmware header to build pointers without first verifying the presence of the header and segment data. A truncated or inconsistent firmware image can cause the driver to read beyond the firmware->data boundary while constructing TCI (Transport Control Interface) commands.

Recommendations Update to version 7.2.5-1.1 or later.