Vulnerability-Lookup

GHSA-8WCP-4XMV-GQVG

Vulnerability from github – Published: 2026-08-15 06:32 – Updated: 2026-08-17 06:33

Details

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci: validate codec capability element length

Read Local Codec Capabilities returns a sequence of capability elements. Each element starts with a one-byte length followed by that many payload bytes.

hci_read_codec_capabilities() checks that the skb contains the length byte, but then validates only caps->len against the remaining skb length. A malformed controller response with one remaining byte and caps->len set to one passes that check even though the element needs two bytes. The parser then records a two-byte capability and copies one byte beyond the advertised response payload into the codec list.

Validate the full element size, including the length byte, before adding it to the accumulated capability length. This preserves all well-formed capability elements and drops only truncated controller responses.

Severity

8.8 (High)


                  
                    CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-74300"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-15T06:22:29Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci: validate codec capability element length\n\nRead Local Codec Capabilities returns a sequence of capability elements.\nEach element starts with a one-byte length followed by that many payload\nbytes.\n\nhci_read_codec_capabilities() checks that the skb contains the length\nbyte, but then validates only caps-\u003elen against the remaining skb\nlength.  A malformed controller response with one remaining byte and\ncaps-\u003elen set to one passes that check even though the element needs two\nbytes.  The parser then records a two-byte capability and copies one\nbyte beyond the advertised response payload into the codec list.\n\nValidate the full element size, including the length byte, before adding\nit to the accumulated capability length.  This preserves all well-formed\ncapability elements and drops only truncated controller responses.",
  "id": "GHSA-8wcp-4xmv-gqvg",
  "modified": "2026-08-17T06:33:37Z",
  "published": "2026-08-15T06:32:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74300"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/290b36f9d1eb9b2f72b40d826f26b4a182ab15f7"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/4bc16db0f11918e07edf9fdcda4a30cf4c9df45c"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/c38fbcdc407925c7088f7e5f11c1fff73d2d35a2"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/ec4d352747a62c1082f16c11a74b37d6eb85a5a3"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/f2ad01f55e07f9531efcea736087e6b8658a3440"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/fc97fc8cf7f53fd3619db63e09050d20a3a0c4b1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2026-74300 (GCVE-0-2026-74300)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:58 – Updated: 2026-08-17 05:45

Title

Bluetooth: hci: validate codec capability element length

Summary

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci: validate codec capability element length Read Local Codec Capabilities returns a sequence of capability elements. Each element starts with a one-byte length followed by that many payload bytes. hci_read_codec_capabilities() checks that the skb contains the length byte, but then validates only caps->len against the remaining skb length. A malformed controller response with one remaining byte and caps->len set to one passes that check even though the element needs two bytes. The parser then records a two-byte capability and copies one byte beyond the advertised response payload into the codec list. Validate the full element size, including the length byte, before adding it to the accumulated capability length. This preserves all well-formed capability elements and drops only truncated controller responses.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

6 references

URL	Tags
https://git.kernel.org/stable/c/fc97fc8cf7f53fd36…
https://git.kernel.org/stable/c/290b36f9d1eb9b2f7…
https://git.kernel.org/stable/c/f2ad01f55e07f9531…
https://git.kernel.org/stable/c/ec4d352747a62c108…
https://git.kernel.org/stable/c/4bc16db0f11918e07…
https://git.kernel.org/stable/c/c38fbcdc407925c70…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 8961987f3f5fa2f2618e72304d013c8dd5e604a6 , < fc97fc8cf7f53fd3619db63e09050d20a3a0c4b1 (git) Affected: 8961987f3f5fa2f2618e72304d013c8dd5e604a6 , < 290b36f9d1eb9b2f72b40d826f26b4a182ab15f7 (git) Affected: 8961987f3f5fa2f2618e72304d013c8dd5e604a6 , < f2ad01f55e07f9531efcea736087e6b8658a3440 (git) Affected: 8961987f3f5fa2f2618e72304d013c8dd5e604a6 , < ec4d352747a62c1082f16c11a74b37d6eb85a5a3 (git) Affected: 8961987f3f5fa2f2618e72304d013c8dd5e604a6 , < 4bc16db0f11918e07edf9fdcda4a30cf4c9df45c (git) Affected: 8961987f3f5fa2f2618e72304d013c8dd5e604a6 , < c38fbcdc407925c7088f7e5f11c1fff73d2d35a2 (git)
Linux	Linux	Affected: 5.16 Unaffected: 0 , < 5.16 (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.97 , ≤ 6.12.* (semver) Unaffected: 6.18.40 , ≤ 6.18.* (semver) Unaffected: 7.1.5 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/hci_codec.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "fc97fc8cf7f53fd3619db63e09050d20a3a0c4b1",
              "status": "affected",
              "version": "8961987f3f5fa2f2618e72304d013c8dd5e604a6",
              "versionType": "git"
            },
            {
              "lessThan": "290b36f9d1eb9b2f72b40d826f26b4a182ab15f7",
              "status": "affected",
              "version": "8961987f3f5fa2f2618e72304d013c8dd5e604a6",
              "versionType": "git"
            },
            {
              "lessThan": "f2ad01f55e07f9531efcea736087e6b8658a3440",
              "status": "affected",
              "version": "8961987f3f5fa2f2618e72304d013c8dd5e604a6",
              "versionType": "git"
            },
            {
              "lessThan": "ec4d352747a62c1082f16c11a74b37d6eb85a5a3",
              "status": "affected",
              "version": "8961987f3f5fa2f2618e72304d013c8dd5e604a6",
              "versionType": "git"
            },
            {
              "lessThan": "4bc16db0f11918e07edf9fdcda4a30cf4c9df45c",
              "status": "affected",
              "version": "8961987f3f5fa2f2618e72304d013c8dd5e604a6",
              "versionType": "git"
            },
            {
              "lessThan": "c38fbcdc407925c7088f7e5f11c1fff73d2d35a2",
              "status": "affected",
              "version": "8961987f3f5fa2f2618e72304d013c8dd5e604a6",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/hci_codec.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.16"
            },
            {
              "lessThan": "5.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci: validate codec capability element length\n\nRead Local Codec Capabilities returns a sequence of capability elements.\nEach element starts with a one-byte length followed by that many payload\nbytes.\n\nhci_read_codec_capabilities() checks that the skb contains the length\nbyte, but then validates only caps-\u003elen against the remaining skb\nlength.  A malformed controller response with one remaining byte and\ncaps-\u003elen set to one passes that check even though the element needs two\nbytes.  The parser then records a two-byte capability and copies one\nbyte beyond the advertised response payload into the codec list.\n\nValidate the full element size, including the length byte, before adding\nit to the accumulated capability length.  This preserves all well-formed\ncapability elements and drops only truncated controller responses."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The bug is in parsing HCI Read Local Codec Capabilities command-complete data from the Bluetooth controller during HCI adapter initialization; a nearby attacker who compromises or impersonates the controller (integrated phone BT, laptop adapter, automotive head unit) can deliver malformed responses over the Bluetooth hardware link.\nAC:L - Exploitation only requires crafting controller response fields (num_caps and per-element length bytes) that pass the flawed length check; no races, timing windows, or victim-specific memory layout are needed, and the attacker fully controls the malformed HCI payload.\nPR:N - No privileges on the victim host are required; the kernel issues the HCI commands during automatic Bluetooth bring-up and trusts controller replies, so an external adjacent attacker supplying malicious controller responses needs no local account, capabilities, or user-namespace admin rights.\nUI:N - Triggering occurs during HCI device initialization when Bluetooth is powered on, which is automatic at boot or through normal always-on Bluetooth use on phones, headsets, and vehicles, without any special victim action beyond routine Bluetooth operation.\nS:U - Impact is confined to kernel memory handling within the host Bluetooth stack during codec enumeration; it does not cross a security boundary such as VM escape, container breakout, or IOMMU/DMA isolation bypass.\nC:H - The inflated capability length causes memcpy in hci_codec_list_add to read beyond the HCI response skb into adjacent kernel memory, leaking up to hundreds of bytes per response into permanently cached codec_list entries that can later be exposed via BT_CODEC socket queries.\nI:H - Out-of-bounds kernel heap access during parsing constitutes memory corruption; attacker-controlled lengths pollute kernel codec capability cache state and the same class of length-validation bugs in Bluetooth HCI parsing is routinely chained into further kernel compromise.\nA:H - Reading past the skb tail can provoke kernel faults or panics on strict memory-sanitizer builds, and corrupted codec enumeration during hci_dev_open_sync can abort Bluetooth initialization, denying Bluetooth availability until reboot or adapter reset."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:45:37.190Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/fc97fc8cf7f53fd3619db63e09050d20a3a0c4b1"
        },
        {
          "url": "https://git.kernel.org/stable/c/290b36f9d1eb9b2f72b40d826f26b4a182ab15f7"
        },
        {
          "url": "https://git.kernel.org/stable/c/f2ad01f55e07f9531efcea736087e6b8658a3440"
        },
        {
          "url": "https://git.kernel.org/stable/c/ec4d352747a62c1082f16c11a74b37d6eb85a5a3"
        },
        {
          "url": "https://git.kernel.org/stable/c/4bc16db0f11918e07edf9fdcda4a30cf4c9df45c"
        },
        {
          "url": "https://git.kernel.org/stable/c/c38fbcdc407925c7088f7e5f11c1fff73d2d35a2"
        }
      ],
      "title": "Bluetooth: hci: validate codec capability element length",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74300",
    "datePublished": "2026-08-15T05:58:03.348Z",
    "dateReserved": "2026-08-15T05:44:03.882Z",
    "dateUpdated": "2026-08-17T05:45:37.190Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

GHSA-8WCP-4XMV-GQVG

CVE-2026-74300 (GCVE-0-2026-74300)

Tags

Sightings

Nomenclature