CVE-2026-80760

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: MGMT: reject HCI CMD SYNC params len above 255

mgmt hci cmd sync() checks that the message length agrees with params len but puts no upper bound on it. params len is le16 while the parameter length in the HCI command header is a u8:

struct hci command hdr {
	 le16	opcode;
	 u8	plen;
}  packed;

hci cmd sync alloc() assigns one to the other:

hdr->plen = plen;

if (plen)
	skb put data(skb, param, plen);

so a params len of 256 leaves plen at 0 while all 256 bytes are still appended. The frame handed to the driver then declares no parameters and carries 256 of them. On a length framed transport such as H:4 the controller takes the trailing bytes as the start of the next packet.

The mgmt socket MTU is HCI MAX FRAME SIZE, so params len can reach about 1KB this way. Commit 03f1700b9b4d ("Bluetooth: MGMT: reject malformed HCI CMD SYNC commands") only made params len agree with the message length, a value that fits the message but not the header field is still accepted.

Reject params len that does not fit the header field.