CVE-2026-80759

What it actually does

The aml_download_firmware function reads length fields from a firmware header and derives pointers to ICCM and DCCM segments without first verifying that the header and full segment data exist inside the loaded firmware blob, enabling out-of-bounds reads on truncated or malformed images.

Why it matters to the business

Systems using affected Bluetooth hardware may experience kernel crashes or memory corruption when the driver attempts to load an inconsistent firmware image, leading to loss of Bluetooth functionality and potential device instability.

How an attack unfolds

An attacker supplies a deliberately truncated or inconsistent firmware image to the Bluetooth stack; when the hci_aml driver calls aml_download_firmware it reads the unchecked lengths and constructs invalid pointers, resulting in reads past the end of the firmware buffer.

How to fix it

Apply the upstream kernel commit that adds explicit checks rejecting images shorter than the header and ensuring both ICCM and DCCM ranges fit inside the loaded firmware before any segment download occurs.

How to confirm the fix worked

Inspect the aml_download_firmware function in drivers/bluetooth/hci_aml.c for the added length and bounds checks; confirm the driver now returns an error for any firmware whose declared segments exceed its actual size.

Typical attack path

1. Obtain or craft a firmware image shorter than required for its declared ICCM/DCCM segments
2. Place the image where the hci_aml driver will load it
3. Trigger firmware download via normal Bluetooth initialization or a user-initiated scan
4. Driver performs unchecked pointer arithmetic and reads past firmware->data

How to detect it

Review kernel logs for oops or panic messages originating from hci_aml.c or aml_download_firmware; correlate with Bluetooth initialization events or attempts to load firmware files.

What your security team should do

• Prioritize kernel updates containing the firmware validation fix on all systems with AML Bluetooth hardware
• Temporarily disable the affected Bluetooth driver if updates cannot be applied promptly
• Monitor vendor firmware update channels for any accompanying image corrections