CVE-2026-74300 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hci: validate codec capability element length
Read Local Codec Capabilities returns a sequence of capability elements. Each element starts with a one-byte length followed by that many payload bytes.
hci_read_codec_capabilities() checks that the skb contains the length byte, but then validates only caps->len against the remaining skb length. A malformed controller response with one remaining byte and caps->len set to one passes that check even though the element needs two bytes. The parser then records a two-byte capability and copies one byte beyond the advertised response payload into the codec list.
Validate the full element size, including the length byte, before adding it to the accumulated capability length. This preserves all well-formed capability elements and drops only truncated controller responses.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability in question affects the Linux kernel's Bluetooth subsystem, specifically within the HCI (Host Controller Interface) layer responsible for handling Bluetooth communication protocols. This issue resides in the hci_read_codec_capabilities() function which processes responses from Bluetooth controllers containing codec capability information. The problem manifests when the kernel attempts to parse local codec capabilities returned by Bluetooth controllers, where each capability element follows a structured format beginning with a one-byte length field followed by the specified number of payload bytes. The flaw occurs during validation of these capability elements, creating a potential buffer over-read condition that could be exploited to corrupt memory or execute arbitrary code.
The technical implementation flaw stems from an inadequate validation check within the parsing logic where the function only verifies that the announced length of a capability element does not exceed the remaining buffer space but fails to account for the mandatory one-byte length field itself. When a malicious or faulty Bluetooth controller responds with a malformed packet containing a single remaining byte in the buffer yet sets the length field to indicate two bytes, the validation passes incorrectly. This allows the parser to proceed with processing an element that would require two bytes total (one for length plus one for payload) while only having one byte available, resulting in a copy operation that reads beyond the allocated buffer boundaries and potentially overwrites adjacent memory regions.
This vulnerability presents significant operational impact within Linux systems utilizing Bluetooth functionality, particularly those running kernel versions affected by this issue. The potential consequences include system instability, denial of service conditions where Bluetooth services crash or become unresponsive, and more critically, memory corruption that could enable privilege escalation attacks. Attackers could potentially exploit this through malicious Bluetooth devices or compromised controller responses to cause system crashes or gain elevated privileges on affected systems. The vulnerability affects any system where Bluetooth is enabled and the kernel processes codec capability information from remote devices.
Mitigation strategies should focus on applying the official kernel patches that correct the validation logic by ensuring full element size validation including the mandatory length byte before processing capability elements. System administrators should prioritize updating to patched kernel versions, particularly those containing the specific fix for this HCI Bluetooth vulnerability. Additionally, organizations should implement monitoring of Bluetooth subsystem logs for unusual behavior or error messages related to codec capability parsing, and consider disabling Bluetooth functionality on systems where it is not required. The fix aligns with security best practices outlined in CWE-129 Input Validation and CWE-787 Out-of-bounds Write, while also addressing ATT&CK techniques related to privilege escalation through memory corruption vulnerabilities. Regular kernel updates and security audits of Bluetooth implementations remain critical for maintaining system integrity against similar parsing vulnerabilities.