CVE-2026-80761

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the Bluetooth ISO implementation where the iso sock getname() function fails to clear the sockaddr iso structure before returning its size. This results in uninitialized bytes from the kernel stack being copied to user space. Specifically, a trailing pad byte is leaked on every call to getsockname(), and for broadcast peers (BIS LINK or PA LINK), the first 7 bytes of the sockaddr iso bc structure (including bc bdaddr and bc bdaddr type) are not written and thus leaked. An unprivileged process can trigger the pad leak by opening a BTPROTO ISO socket and calling getsockname(), while the broadcast leak requires an established BIS/PA connection.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.