CVE-2026-80763

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the Bluetooth component where the Command Complete dispatch only validates the fixed portion of the LE Set CIG Parameters response. The function hci cc le set cig params() relies on the num handles variable to read entries in the trailing handle array without verifying if the response actually contains all advertised handles. Consequently, a truncated response from a malfunctioning controller can cause the handler to read beyond the skb (socket buffer) data.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.