CVE-2026-80760

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.5-1.1

Description An issue exists in the Bluetooth MGMT component where the mgmt hci cmd sync() function fails to enforce an upper bound on the params len variable. While params len is defined as a 16-bit little-endian integer ( le16), the parameter length in the HCI command header is only an 8-bit unsigned integer (u8).

When hci cmd sync alloc() assigns params len to the header's plen field, a value of 256 causes plen to wrap around to 0, while all 256 bytes remain appended to the data. This results in a frame that declares no parameters but actually carries 256 bytes. On length-framed transports like H:4, the controller may interpret these trailing bytes as the start of a subsequent packet. Due to the mgmt socket MTU, params len can potentially reach approximately 1KB.

Recommendations Update the Linux kernel to version 7.2.5-1.1 or later.