CVE-2026-80759

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_aml: validate firmware segment lengths aml_download_firmware() reads two lengths from the firmware header and uses them to build pointers before checking that the header and segment data are present. A truncated or inconsistent firmware image can make the driver read past firmware->data while constructing TCI commands. Reject images shorter than the header and ensure that the ICCM and DCCM ranges fit within the loaded firmware before downloading either segment.

CVSS

No CVSS.

References

Link	Resource
https://git.kernel.org/stable/c/2763b8bcb504e30ec955474f51b99ce42fc62f3b
https://git.kernel.org/stable/c/2bf6b9baca9372ea51b6d0f2820dc9bf29a83ef4
https://git.kernel.org/stable/c/6c70253462902d835e843b470f74aa816d60af80
https://git.kernel.org/stable/c/7733b01ed13685773ccda91035a46f87d4cfef7c
https://git.kernel.org/stable/c/e1534d49a7b8ba728e84b020f6d802aa1cb759d9

Configurations

No configuration.

History

No history.

Information

Published : 2026-09-04 16:18

Updated : 2026-09-04 16:18

NVD link : CVE-2026-80759

Mitre link : CVE-2026-80759

CVE.ORG link : CVE-2026-80759

JSON object : View

Products Affected

No product.

CWE

No CWE.

{"id": "CVE-2026-80759", "cveTags": [], "metrics": {}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "37bac77e4649e8158698a60addc22ec4faf5649a", "lessThan": "7733b01ed13685773ccda91035a46f87d4cfef7c", "versionType": "git"}, {"status": "affected", "version": "37bac77e4649e8158698a60addc22ec4faf5649a", "lessThan": "e1534d49a7b8ba728e84b020f6d802aa1cb759d9", "versionType": "git"}, {"status": "affected", "version": "37bac77e4649e8158698a60addc22ec4faf5649a", "lessThan": "6c70253462902d835e843b470f74aa816d60af80", "versionType": "git"}, {"status": "affected", "version": "37bac77e4649e8158698a60addc22ec4faf5649a", "lessThan": "2763b8bcb504e30ec955474f51b99ce42fc62f3b", "versionType": "git"}, {"status": "affected", "version": "37bac77e4649e8158698a60addc22ec4faf5649a", "lessThan": "2bf6b9baca9372ea51b6d0f2820dc9bf29a83ef4", "versionType": "git"}], "programFiles": ["drivers/bluetooth/hci_aml.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.12"}, {"status": "unaffected", "version": "0", "lessThan": "6.12", "versionType": "semver"}, {"status": "unaffected", "version": "6.12.106", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.47", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.11", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2.1", "versionType": "semver", "lessThanOrEqual": "7.2.*"}, {"status": "unaffected", "version": "7.3-rc1", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/bluetooth/hci_aml.c"], "defaultStatus": "affected"}]}], "published": "2026-09-04T16:18:00.950", "references": [{"url": "https://git.kernel.org/stable/c/2763b8bcb504e30ec955474f51b99ce42fc62f3b", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/2bf6b9baca9372ea51b6d0f2820dc9bf29a83ef4", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/6c70253462902d835e843b470f74aa816d60af80", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/7733b01ed13685773ccda91035a46f87d4cfef7c", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/e1534d49a7b8ba728e84b020f6d802aa1cb759d9", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Received", "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_aml: validate firmware segment lengths\n\naml_download_firmware() reads two lengths from the firmware header and\nuses them to build pointers before checking that the header and segment\ndata are present. A truncated or inconsistent firmware image can make\nthe driver read past firmware->data while constructing TCI commands.\n\nReject images shorter than the header and ensure that the ICCM and DCCM\nranges fit within the loaded firmware before downloading either segment."}], "lastModified": "2026-09-04T16:18:00.950", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}