CVE-2026-80759
Received Received - Intake

Bluetooth Firmware Length Validation Flaw in Linux Kernel

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_aml: validate firmware segment lengths aml_download_firmware() reads two lengths from the firmware header and uses them to build pointers before checking that the header and segment data are present. A truncated or inconsistent firmware image can make the driver read past firmware->data while constructing TCI commands. Reject images shorter than the header and ensure that the ICCM and DCCM ranges fit within the loaded firmware before downloading either segment.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-80759
EUVD
EUVD-2026-71402

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves the Bluetooth driver hci_aml. The function aml_download_firmware reads two length values from a firmware header to create pointers without first verifying the header and segment data are present. A malformed or truncated firmware file could cause the driver to read beyond the allocated firmware data while building TCI commands.

Detection Guidance

This vulnerability is specific to the Linux kernel's Bluetooth HCI AML driver and requires checking for firmware validation issues. Monitor kernel logs for Bluetooth-related errors or crashes during firmware loading. Check if your system uses the affected driver by running: dmesg | grep -i aml_download_firmware. Ensure firmware files are not truncated by verifying their integrity with tools like sha256sum.

Impact Analysis

An attacker could exploit this to cause a denial of service by crashing the system or potentially execute arbitrary code in the kernel context. This could lead to system instability or unauthorized access if the kernel is compromised.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for CVE-2026-80759. Avoid using custom or modified Bluetooth firmware files. If you cannot update immediately, disable the affected Bluetooth driver module by running: sudo rmmod hci_aml. Monitor vendor advisories for patches.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80759. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart