CVE-2026-74300

Received Received - Intake

Bluetooth: hci Codec Capability Length Validation Flaw

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci: validate codec capability element length Read Local Codec Capabilities returns a sequence of capability elements. Each element starts with a one-byte length followed by that many payload bytes. hci_read_codec_capabilities() checks that the skb contains the length byte, but then validates only caps->len against the remaining skb length. A malformed controller response with one remaining byte and caps->len set to one passes that check even though the element needs two bytes. The parser then records a two-byte capability and copies one byte beyond the advertised response payload into the codec list. Validate the full element size, including the length byte, before adding it to the accumulated capability length. This preserves all well-formed capability elements and drops only truncated controller responses.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-74300

EUVD

EUVD-2026-59447

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves improper validation of Bluetooth codec capability elements. When a device reads local codec capabilities, the response includes elements with a length byte followed by payload bytes. The parser checks only part of the length, allowing malformed responses to pass. This can lead to reading beyond the intended data, corrupting the codec list.

Detection Guidance

This vulnerability is specific to the Linux kernel's Bluetooth subsystem. Detection requires checking the kernel version and Bluetooth stack for affected components. Use commands like 'uname -a' to check the kernel version and 'dmesg | grep Bluetooth' to inspect Bluetooth-related logs for errors.

Impact Analysis

This vulnerability could allow an attacker to cause a denial of service or potentially execute arbitrary code on a system with a vulnerable Linux kernel. It may lead to system crashes or instability if exploited via a malformed Bluetooth controller response.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a low-level Bluetooth stack issue in the Linux kernel. Compliance risks would only arise if the vulnerability were exploited to gain unauthorized access to sensitive data, which is not described in the provided context.

Mitigation Strategies

Immediately update the Linux kernel to a patched version that includes the fix for CVE-2026-74300. Disable Bluetooth if not in use and monitor vendor advisories for firmware updates. Restrict Bluetooth device connections to trusted sources.

Hi! I’m here to help you understand CVE-2026-74300. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70