SB2026090604 - Numeric Truncation Error in Linux kernel bluetooth

Description

This security bulletin contains information about 1 vulnerability.

1) Numeric Truncation Error (CVE-ID: CVE-2026-80760)

CWE-ID: CWE-197 - Numeric Truncation Error

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause Bluetooth controller packet desynchronization.

The vulnerability exists due to improper numeric truncation in mgmt_hci_cmd_sync when handling HCI_CMD_SYNC commands with a parameter length exceeding the HCI command header field capacity. A local user can send a specially crafted management command to cause Bluetooth controller packet desynchronization.

On length-framed transports such as H:4, trailing parameter bytes can be interpreted as the beginning of the next packet.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/0bd0195ce25737cbdd0eabc54319ee0ddf3a0ad2
• https://git.kernel.org/stable/c/5d95286b6d6e8f1d304da7522bfa6860fc017e48
• https://git.kernel.org/stable/c/6e1c44878aa3ee7336efeaf01414b030b0a5c273
• https://git.kernel.org/stable/c/b7d9edcf9fe6e9ec3a2e80ef9e8d44ef9b4f2894