CVE-2026-80759Bluetooth: hci_aml: validate firmware segment lengths
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_aml: validate firmware segment lengths aml_download_firmware() reads two lengths from the firmware header and uses them to build pointers before checking that the header and segment data are present. A truncated or inconsistent firmware image can make the driver read past firmware->data while constructing TCI commands. Reject images shorter than the header and ensure that the ICCM and DCCM ranges fit within the loaded firmware before downloading either segment.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 4, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 37bac77e4649e8158698a60addc22ec4faf5649a before 7733b01ed13685773ccda91035a46f87d4cfef7c; from 37bac77e4649e8158698a60addc22ec4faf5649a before e1534d49a7b8ba728e84b020f6d802aa1cb759d9; 37bac77e4649e8158698a60addc22ec4faf5649a builds before 6c70253462902d835e843b470f74aa816d60af80; from 37bac77e4649e8158698a60addc22ec4faf5649a before 2763b8bcb504e30ec955474f51b99ce42fc62f3b; 37bac77e4649e8158698a60addc22ec4faf5649a builds before 2bf6b9baca9372ea51b6d0f2820dc9bf29a83ef4 | CNA record |
References
- https://git.kernel.org/stable/c/7733b01ed13685773ccda91035a46f87d4cfef7c
- https://git.kernel.org/stable/c/e1534d49a7b8ba728e84b020f6d802aa1cb759d9
- https://git.kernel.org/stable/c/6c70253462902d835e843b470f74aa816d60af80
- https://git.kernel.org/stable/c/2763b8bcb504e30ec955474f51b99ce42fc62f3b
- https://git.kernel.org/stable/c/2bf6b9baca9372ea51b6d0f2820dc9bf29a83ef4
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.