CVE-2026-80759

    Dashboard / Vulnerabilities / CVE-2026-80759

    CVE-2026-80759

    Published: 4 Sept 2026Last Modified: 15 Sept 2026

    Summary: Bluetooth: hci_aml: validate firmware segment lengths

    Details: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_aml: validate firmware segment lengths aml_download_firmware() reads two lengths from the firmware header and uses them to build pointers before checking that the header and segment data are present. A truncated or inconsistent firmware image can make the driver read past firmware->data while constructing TCI commands. Reject images shorter than the header and ensure that the ICCM and DCCM ranges fit within the loaded firmware before downloading either segment.

    References: https://git.kernel.org/stable/c/2763b8bcb504e30ec955474f51b99ce42fc62f3b, https://git.kernel.org/stable/c/2bf6b9baca9372ea51b6d0f2820dc9bf29a83ef4, https://git.kernel.org/stable/c/6c70253462902d835e843b470f74aa816d60af80, https://git.kernel.org/stable/c/7733b01ed13685773ccda91035a46f87d4cfef7c, https://git.kernel.org/stable/c/e1534d49a7b8ba728e84b020f6d802aa1cb759d9, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80759.json, https://nvd.nist.gov/vuln/detail/CVE-2026-80759, https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 37bac77e4649e8158698a60addc22ec4faf5649a
    Fixed -7733b01ed13685773ccda91035a46f87d4cfef7c

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-80759 | CVE-DB