Numeric Truncation Error in Linux kernel - CVE-2026-80760

Vulnerability identifier: #VU147155

CSH Severity: Low

CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-80760

CWE-ID: CWE-197

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to cause Bluetooth controller packet desynchronization.

The vulnerability exists due to improper numeric truncation in mgmt_hci_cmd_sync when handling HCI_CMD_SYNC commands with a parameter length exceeding the HCI command header field capacity. A local user can send a specially crafted management command to cause Bluetooth controller packet desynchronization.

On length-framed transports such as H:4, trailing parameter bytes can be interpreted as the beginning of the next packet.

Linux kernel
Ubuntu
linux (Ubuntu package)
linux-aws (Ubuntu package)
linux-gcp (Ubuntu package)
linux-oracle (Ubuntu package)
linux-ibm (Ubuntu package)
linux-hwe-7.0 (Ubuntu package)
linux-oem-7.0 (Ubuntu package)

Install security update from vendor's repository.

linux (Ubuntu package) - update to 7.0.0-42.42
linux-aws (Ubuntu package) - update to 7.0.0-1016.17
linux-gcp (Ubuntu package) - update to 7.0.0-1016.18
linux-oracle (Ubuntu package) - update to 7.0.0-1015.16
linux-ibm (Ubuntu package) - update to 7.0.0-1017.17
linux-hwe-7.0 (Ubuntu package) - update to 7.0.0-42.42~24.04.1
linux-oem-7.0 (Ubuntu package) - update to 7.0.0-1017.17

• https://git.kernel.org/stable/c/0bd0195ce25737cbdd0eabc54319ee0ddf3a0ad2
• https://git.kernel.org/stable/c/5d95286b6d6e8f1d304da7522bfa6860fc017e48
• https://git.kernel.org/stable/c/6e1c44878aa3ee7336efeaf01414b030b0a5c273
• https://git.kernel.org/stable/c/b7d9edcf9fe6e9ec3a2e80ef9e8d44ef9b4f2894

• Numeric Truncation Error in Linux kernel bluetooth
• Ubuntu update for linux-oem-7.0
• Ubuntu update for linux, linux-aws, linux-gcp and more