CVE-2026-80763 in Linux
Summary
by MITRE • 09/04/2026
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hci_event: validate LE Set CIG Parameters response
The Command Complete dispatch validates only the fixed part of the LE Set CIG Parameters response. After that part is pulled from the skb, hci_cc_le_set_cig_params() trusts num_handles and reads each entry in the trailing handle array.
Matching num_handles against the command's num_cis does not guarantee that the response contains the advertised handles. A truncated response from a malfunctioning controller can therefore make the handler read beyond the skb data.
Validate that the remaining skb data contains all advertised handles. Include this in the existing response validation so malformed responses also follow the established CIG failure handling.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/04/2026
The Linux kernel Bluetooth subsystem, specifically within the HCI event processing logic for LE Connection Synchronization Parameter (CIG) setup, contained a critical input validation flaw that could lead to out-of-bounds memory reads. The vulnerability resides in the handler function hci_cc_le_set_cig_params which processes Command Complete events returned by the Bluetooth controller after receiving an LE Set CIG Parameters command. This specific area of the codebase is responsible for managing audio streaming configurations and connection parameters, making it a high-value target for attackers seeking to disrupt system stability or potentially execute arbitrary code through memory corruption techniques.
The core technical flaw stems from insufficient validation of the response payload length relative to the number of handles advertised in the command. When the controller responds with an LE Set CIG Parameters Complete event, the kernel initially validates only the fixed-size portion of the response structure. Following this initial check, the code extracts a variable named num_handles and proceeds to iterate through a trailing array of handle entries based on this count. However, the existing validation logic fails to verify that the remaining data in the socket buffer (skb) actually contains enough bytes to accommodate all num_handles entries. This oversight means that if a malicious or malfunctioning Bluetooth controller sends a truncated response where the payload length is shorter than expected for the stated number of handles, the kernel will continue reading beyond the allocated memory boundaries of the skb.
This out-of-bounds read constitutes an information disclosure vulnerability and potentially a denial of service condition depending on how the accessed data influences subsequent control flow or if it triggers page faults that crash the process. In more severe scenarios involving further exploitation chains, such as use-after-free conditions triggered by corrupted state derived from invalid handle values, this could escalate to remote code execution. The attack vector typically involves interacting with a compromised or rogue Bluetooth peripheral device during the CIG setup phase. By sending a malformed Command Complete event with an inflated num_handles field but a short payload, an attacker can force the kernel driver to read arbitrary memory contents located immediately after the skb buffer in physical memory.
From a classification perspective, this vulnerability aligns closely with CWE-125 Out-of-bounds Read and CWE-20 Improper Input Validation within the Common Weakness Enumeration framework. In terms of offensive security tactics, it relates to ATT&CK technique T1608 Linked-in Components where attackers leverage legitimate system components for exploitation, although in this specific case, the primary impact is stability rather than persistence or privilege escalation directly from the read itself. The failure lies in trusting external input without verifying its structural integrity against declared lengths, a classic error in network protocol parsing logic common in kernel drivers that handle variable-length data structures.
The remediation implemented addresses this by adding explicit bounds checking to ensure that the remaining length of the skb is sufficient to contain all num_handles entries before attempting to access them. This validation step ensures that malformed responses are treated consistently with other CIG failure scenarios, triggering appropriate error handling paths rather than proceeding with unsafe memory accesses. By enforcing strict adherence between advertised counts and actual data availability, the patch eliminates the possibility of reading beyond buffer boundaries during this specific HCI event processing stage.
To mitigate similar risks in broader contexts, developers should always validate that variable-length fields such as count or length indicators are strictly bounded by the total size of the received packet before iterating over associated arrays. This principle applies to all network-facing kernel subsystems including Bluetooth, Wi-Fi drivers, and USB controllers. Regular static analysis tools configured with rules for buffer overflow detection can help identify these patterns early in development. Additionally, fuzzing HCI event handlers against malformed inputs is a recommended practice to uncover edge cases where protocol implementations may not strictly enforce length constraints as required by the Bluetooth specification.