CVE-2026-80761
Received Received - Intake

Bluetooth ISO Stack Memory Leak in Linux Kernel

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: zero the sockaddr before returning it in getname iso_sock_getname() fills a struct sockaddr_iso in place and returns its size without clearing it first, so bytes it does not write are copied to user space from the kernel stack. The getsockname(2) and getpeername(2) paths both run through do_getsockname(), which hands getname() an uninitialized sockaddr_storage on the stack and copies back up to the number of bytes getname() returns, so the driver has to initialize every byte it accounts for. Two ranges are left uninitialized: - struct sockaddr_iso is 10 bytes but only 9 are written (family, iso_bdaddr, iso_bdaddr_type), leaking the trailing pad byte on every call. - for a broadcast peer (BIS_LINK or PA_LINK) the returned length grows by sizeof(struct sockaddr_iso_bc), but only bc_sid, bc_num_bis and bc_bis are filled; bc_bdaddr and bc_bdaddr_type, the first 7 bytes of that structure, are never written. An unprivileged process can open a BTPROTO_ISO socket and reach the pad leak with getsockname(); the broadcast leak needs an established BIS/PA connection. l2cap and rfcomm already memset their sockaddr in getname for the same reason; do the same here.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-80761
EUVD
EUVD-2026-71404

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a Bluetooth ISO socket function that fails to clear memory before returning address information. The iso_sock_getname() function writes data to a sockaddr_iso structure but leaves some bytes uninitialized, which are then copied to user space. This leaks kernel stack data, potentially exposing sensitive information.

Detection Guidance

This vulnerability can be detected by checking for uninitialized memory leaks in Bluetooth ISO sockets. Use commands like 'ss -tulnp | grep iso' to inspect ISO sockets or 'strace -e trace=getsockname getent protocols' to monitor getsockname calls for uninitialized data.

Impact Analysis

An unprivileged user could exploit this to leak small amounts of kernel memory by calling getsockname() on a BTPROTO_ISO socket. For systems with broadcast connections, more data could be leaked. This may allow attackers to gather information about kernel memory layout or other sensitive data.

Compliance Impact

This vulnerability involves information leakage from kernel memory to user space via uninitialized bytes in Bluetooth ISO socket addresses. It does not directly impact data confidentiality or integrity but could potentially expose internal kernel memory contents. For GDPR, this may raise concerns about unauthorized data exposure. For HIPAA, it could be a minor risk if sensitive kernel data were exposed, though no evidence suggests such exposure occurred.

Mitigation Strategies

Apply the Linux kernel patch that initializes the sockaddr structure in iso_sock_getname(). Update to a patched kernel version. Restart affected services after applying the fix.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80761. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart