Cloudanix VulnDB

CVE-2026-80763

None

CVSS

—

EPSS

0.2%

Published

Sep 4, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in Linux kernel Bluetooth handling can let a bad wireless response crash the system or read a little extra memory.

Exploitation
Other
Attacker needs
Other
Complexity
High
Impact
Data Exposure
Component
OS kernel
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Out-of-bounds read in the Linux kernel Bluetooth HCI event handler when processing a truncated LE Set CIG Parameters Command Complete response; the handler trusts num_handles without verifying that the skb contains sufficient data for the full handle array.

Why it matters to the business

Linux systems using Bluetooth LE Audio or related CIG features risk kernel crashes, memory corruption, or limited information disclosure, potentially disrupting wireless audio, peripherals, or requiring reboots in affected devices.

How an attack unfolds

An attacker supplies or emulates a malfunctioning Bluetooth controller that returns a Command Complete event for LE Set CIG Parameters containing fewer bytes than advertised by num_handles; the unvalidated skb access then reads past the buffer, triggering the flaw.

How to fix it

Apply the upstream kernel patch that extends response validation to confirm the skb holds all advertised handles before processing; rebuild and deploy the fixed kernel on all affected Linux systems.

How to confirm the fix worked

Confirm the patched hci_cc_le_set_cig_params function performs an skb length check against (sizeof(struct hci_cc_le_set_cig_params) + num_handles * sizeof(__le16)) before accessing the handle array; test with deliberately short responses.

Typical attack path

  1. Establish a Bluetooth connection that triggers LE Set CIG Parameters command
  2. Return a deliberately truncated or malformed Command Complete response with inflated num_handles
  3. hci_cc_le_set_cig_params reads beyond the skb, causing out-of-bounds access
  4. Kernel panics or leaks adjacent memory contents

How to detect it

Review kernel logs for Bluetooth HCI or skb-related oops/panic messages around the time of LE Set CIG Parameters usage; correlate with unexpected controller behavior or recent Bluetooth audio session starts.

What your security team should do

  • Patch Bluetooth-enabled Linux kernels immediately to the version containing the skb validation fix
  • Monitor Bluetooth stack stability on devices that use LE Audio or ISO channels
  • Disable Bluetooth LE features if patching is delayed and the functionality is non-essential

The record

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: validate LE Set CIG Parameters response The Command Complete dispatch validates only the fixed part of the LE Set CIG Parameters response. After that part is pulled from the skb, hci_cc_le_set_cig_params() trusts num_handles and reads each entry in the trailing handle array. Matching num_handles against the command's num_cis does not guarantee that the response contains the advertised handles. A truncated response from a malfunctioning controller can therefore make the handler read beyond the skb data. Validate that the remaining skb data contains all advertised handles. Include this in the existing response validation so malformed responses also follow the established CIG failure handling.

Affected packages

Ecosystem Package Introduced Fixed