Executive brief
The Linux kernel's Bluetooth subsystem contains a flaw in processing codec capability data from Bluetooth controllers. A malformed controller response can cause the kernel to read memory beyond the provided response payload, potentially exposing sensitive data or causing system instability. This affects systems with Bluetooth hardware enabled.
Technical details
The vulnerability is a buffer over-read (CWE-125) in the hci_read_codec_capabilities() function in net/bluetooth/hci_codec.c. The function parses codec capability elements from a Bluetooth controller response, where each element consists of a one-byte length field followed by payload bytes. The original code validated that the socket buffer (skb) length was sufficient for the payload (caps->len) but failed to account for the length field itself. A malformed controller response with caps->len set larger than the actual remaining data can pass validation, causing the subsequent code to copy data beyond the advertised response payload. An attacker with adjacent network access (via Bluetooth) can craft a malicious response to trigger an out-of-bounds read. The patch adds sizeof(caps->len) to the validation check, ensuring the full element size is validated before processing. Patches are available upstream.
Affected products
- Linux Linux kernel All versions prior to patch commit c38fbcdc407925c7088f7e5f11c1fff73d2d35a2
Timeline
- 2026-08-15: disclosed
- 2026-07-24: patched: Upstream patch commit c38fbcdc407925c7088f7e5f11c1fff73d2d35a2