CVE-2026-74300

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the Bluetooth HCI subsystem where the hci read codec capabilities() function fails to properly validate the length of codec capability elements. When processing a sequence of capability elements, the function checks for the presence of a length byte but only validates the caps->len variable against the remaining socket buffer (skb) length. A malformed controller response can bypass this check, leading the parser to copy one byte beyond the actual response payload into the codec list.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.