GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-74300 (GCVE-0-2026-74300)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:58 – Updated: 2026-08-17 05:45
VLAI
Title
Bluetooth: hci: validate codec capability element length
Summary
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci: validate codec capability element length Read Local Codec Capabilities returns a sequence of capability elements. Each element starts with a one-byte length followed by that many payload bytes. hci_read_codec_capabilities() checks that the skb contains the length byte, but then validates only caps->len against the remaining skb length. A malformed controller response with one remaining byte and caps->len set to one passes that check even though the element needs two bytes. The parser then records a two-byte capability and copies one byte beyond the advertised response payload into the codec list. Validate the full element size, including the length byte, before adding it to the accumulated capability length. This preserves all well-formed capability elements and drops only truncated controller responses.
Severity
8.8 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 8961987f3f5fa2f2618e72304d013c8dd5e604a6 , < fc97fc8cf7f53fd3619db63e09050d20a3a0c4b1 (git)
Affected: 8961987f3f5fa2f2618e72304d013c8dd5e604a6 , < 290b36f9d1eb9b2f72b40d826f26b4a182ab15f7 (git)
Affected: 8961987f3f5fa2f2618e72304d013c8dd5e604a6 , < f2ad01f55e07f9531efcea736087e6b8658a3440 (git)
Affected: 8961987f3f5fa2f2618e72304d013c8dd5e604a6 , < ec4d352747a62c1082f16c11a74b37d6eb85a5a3 (git)
Affected: 8961987f3f5fa2f2618e72304d013c8dd5e604a6 , < 4bc16db0f11918e07edf9fdcda4a30cf4c9df45c (git)
Affected: 8961987f3f5fa2f2618e72304d013c8dd5e604a6 , < c38fbcdc407925c7088f7e5f11c1fff73d2d35a2 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.16
Unaffected: 0 , < 5.16 (semver)
Unaffected: 6.1.178 , ≤ 6.1.* (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/hci_codec.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "fc97fc8cf7f53fd3619db63e09050d20a3a0c4b1",
              "status": "affected",
              "version": "8961987f3f5fa2f2618e72304d013c8dd5e604a6",
              "versionType": "git"
            },
            {
              "lessThan": "290b36f9d1eb9b2f72b40d826f26b4a182ab15f7",
              "status": "affected",
              "version": "8961987f3f5fa2f2618e72304d013c8dd5e604a6",
              "versionType": "git"
            },
            {
              "lessThan": "f2ad01f55e07f9531efcea736087e6b8658a3440",
              "status": "affected",
              "version": "8961987f3f5fa2f2618e72304d013c8dd5e604a6",
              "versionType": "git"
            },
            {
              "lessThan": "ec4d352747a62c1082f16c11a74b37d6eb85a5a3",
              "status": "affected",
              "version": "8961987f3f5fa2f2618e72304d013c8dd5e604a6",
              "versionType": "git"
            },
            {
              "lessThan": "4bc16db0f11918e07edf9fdcda4a30cf4c9df45c",
              "status": "affected",
              "version": "8961987f3f5fa2f2618e72304d013c8dd5e604a6",
              "versionType": "git"
            },
            {
              "lessThan": "c38fbcdc407925c7088f7e5f11c1fff73d2d35a2",
              "status": "affected",
              "version": "8961987f3f5fa2f2618e72304d013c8dd5e604a6",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/hci_codec.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.16"
            },
            {
              "lessThan": "5.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci: validate codec capability element length\n\nRead Local Codec Capabilities returns a sequence of capability elements.\nEach element starts with a one-byte length followed by that many payload\nbytes.\n\nhci_read_codec_capabilities() checks that the skb contains the length\nbyte, but then validates only caps-\u003elen against the remaining skb\nlength.  A malformed controller response with one remaining byte and\ncaps-\u003elen set to one passes that check even though the element needs two\nbytes.  The parser then records a two-byte capability and copies one\nbyte beyond the advertised response payload into the codec list.\n\nValidate the full element size, including the length byte, before adding\nit to the accumulated capability length.  This preserves all well-formed\ncapability elements and drops only truncated controller responses."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The bug is in parsing HCI Read Local Codec Capabilities command-complete data from the Bluetooth controller during HCI adapter initialization; a nearby attacker who compromises or impersonates the controller (integrated phone BT, laptop adapter, automotive head unit) can deliver malformed responses over the Bluetooth hardware link.\nAC:L - Exploitation only requires crafting controller response fields (num_caps and per-element length bytes) that pass the flawed length check; no races, timing windows, or victim-specific memory layout are needed, and the attacker fully controls the malformed HCI payload.\nPR:N - No privileges on the victim host are required; the kernel issues the HCI commands during automatic Bluetooth bring-up and trusts controller replies, so an external adjacent attacker supplying malicious controller responses needs no local account, capabilities, or user-namespace admin rights.\nUI:N - Triggering occurs during HCI device initialization when Bluetooth is powered on, which is automatic at boot or through normal always-on Bluetooth use on phones, headsets, and vehicles, without any special victim action beyond routine Bluetooth operation.\nS:U - Impact is confined to kernel memory handling within the host Bluetooth stack during codec enumeration; it does not cross a security boundary such as VM escape, container breakout, or IOMMU/DMA isolation bypass.\nC:H - The inflated capability length causes memcpy in hci_codec_list_add to read beyond the HCI response skb into adjacent kernel memory, leaking up to hundreds of bytes per response into permanently cached codec_list entries that can later be exposed via BT_CODEC socket queries.\nI:H - Out-of-bounds kernel heap access during parsing constitutes memory corruption; attacker-controlled lengths pollute kernel codec capability cache state and the same class of length-validation bugs in Bluetooth HCI parsing is routinely chained into further kernel compromise.\nA:H - Reading past the skb tail can provoke kernel faults or panics on strict memory-sanitizer builds, and corrupted codec enumeration during hci_dev_open_sync can abort Bluetooth initialization, denying Bluetooth availability until reboot or adapter reset."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:45:37.190Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/fc97fc8cf7f53fd3619db63e09050d20a3a0c4b1"
        },
        {
          "url": "https://git.kernel.org/stable/c/290b36f9d1eb9b2f72b40d826f26b4a182ab15f7"
        },
        {
          "url": "https://git.kernel.org/stable/c/f2ad01f55e07f9531efcea736087e6b8658a3440"
        },
        {
          "url": "https://git.kernel.org/stable/c/ec4d352747a62c1082f16c11a74b37d6eb85a5a3"
        },
        {
          "url": "https://git.kernel.org/stable/c/4bc16db0f11918e07edf9fdcda4a30cf4c9df45c"
        },
        {
          "url": "https://git.kernel.org/stable/c/c38fbcdc407925c7088f7e5f11c1fff73d2d35a2"
        }
      ],
      "title": "Bluetooth: hci: validate codec capability element length",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74300",
    "datePublished": "2026-08-15T05:58:03.348Z",
    "dateReserved": "2026-08-15T05:44:03.882Z",
    "dateUpdated": "2026-08-17T05:45:37.190Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74300",
      "date": "2026-09-05",
      "epss": "0.00256",
      "percentile": "0.1713"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-74300\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-15T06:22:29.610\",\"lastModified\":\"2026-08-17T06:19:24.093\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nBluetooth: hci: validate codec capability element length\\n\\nRead Local Codec Capabilities returns a sequence of capability elements.\\nEach element starts with a one-byte length followed by that many payload\\nbytes.\\n\\nhci_read_codec_capabilities() checks that the skb contains the length\\nbyte, but then validates only caps-\u003elen against the remaining skb\\nlength.  A malformed controller response with one remaining byte and\\ncaps-\u003elen set to one passes that check even though the element needs two\\nbytes.  The parser then records a two-byte capability and copies one\\nbyte beyond the advertised response payload into the codec list.\\n\\nValidate the full element size, including the length byte, before adding\\nit to the accumulated capability length.  This preserves all well-formed\\ncapability elements and drops only truncated controller responses.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/bluetooth/hci_codec.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"8961987f3f5fa2f2618e72304d013c8dd5e604a6\",\"lessThan\":\"fc97fc8cf7f53fd3619db63e09050d20a3a0c4b1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8961987f3f5fa2f2618e72304d013c8dd5e604a6\",\"lessThan\":\"290b36f9d1eb9b2f72b40d826f26b4a182ab15f7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8961987f3f5fa2f2618e72304d013c8dd5e604a6\",\"lessThan\":\"f2ad01f55e07f9531efcea736087e6b8658a3440\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8961987f3f5fa2f2618e72304d013c8dd5e604a6\",\"lessThan\":\"ec4d352747a62c1082f16c11a74b37d6eb85a5a3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8961987f3f5fa2f2618e72304d013c8dd5e604a6\",\"lessThan\":\"4bc16db0f11918e07edf9fdcda4a30cf4c9df45c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8961987f3f5fa2f2618e72304d013c8dd5e604a6\",\"lessThan\":\"c38fbcdc407925c7088f7e5f11c1fff73d2d35a2\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/bluetooth/hci_codec.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.16\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.16\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.178\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.145\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.97\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.40\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.5\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/290b36f9d1eb9b2f72b40d826f26b4a182ab15f7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/4bc16db0f11918e07edf9fdcda4a30cf4c9df45c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c38fbcdc407925c7088f7e5f11c1fff73d2d35a2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ec4d352747a62c1082f16c11a74b37d6eb85a5a3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f2ad01f55e07f9531efcea736087e6b8658a3440\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/fc97fc8cf7f53fd3619db63e09050d20a3a0c4b1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-20T16:22:34+00:00",
      "cve": "CVE-2026-74300",
      "id": "CVE-2026-74300",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "232",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Bluetooth: hci: validate codec capability element length",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74300.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.