CVE-2026-80763
Received Received - Intake

Bluetooth: HCI LE Set CIG Parameters Response Validation Flaw

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: validate LE Set CIG Parameters response The Command Complete dispatch validates only the fixed part of the LE Set CIG Parameters response. After that part is pulled from the skb, hci_cc_le_set_cig_params() trusts num_handles and reads each entry in the trailing handle array. Matching num_handles against the command's num_cis does not guarantee that the response contains the advertised handles. A truncated response from a malfunctioning controller can therefore make the handler read beyond the skb data. Validate that the remaining skb data contains all advertised handles. Include this in the existing response validation so malformed responses also follow the established CIG failure handling.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-80763
EUVD
EUVD-2026-71406

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Bluetooth vulnerability in the Linux kernel where the LE Set CIG Parameters response is not properly validated. The handler trusts the number of handles in the response but does not verify if the response contains all advertised handles. A truncated response from a faulty controller could cause the handler to read beyond the available data in the skb buffer.

Detection Guidance

This vulnerability is specific to the Linux kernel's Bluetooth subsystem and requires kernel-level inspection. Detection involves checking kernel logs for Bluetooth-related errors or examining the kernel version for affected releases. Use commands like 'dmesg | grep Bluetooth' or 'uname -a' to inspect the kernel version and logs.

Impact Analysis

This vulnerability could lead to memory corruption or crashes in the Linux kernel if a malformed Bluetooth controller sends a truncated response. It may cause system instability or denial of service by exploiting the improper validation of LE Set CIG Parameters responses.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a low-level Bluetooth stack issue in the Linux kernel. Compliance impacts would only occur if this flaw led to data exposure or unauthorized access, which is not described in the provided context.

Mitigation Strategies

Apply the latest kernel update provided by your Linux distribution to patch this vulnerability. If immediate patching is not possible, disable Bluetooth functionality temporarily by unloading the Bluetooth kernel module with 'modprobe -r bluetooth' or disabling the service.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80763. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart