Executive brief
The Linux kernel's Bluetooth driver for Amlogic devices processes firmware files to initialize hardware. A vulnerability in the firmware parsing code allowed the driver to read past the loaded firmware image when processing truncated or inconsistent firmware files, potentially exposing kernel memory. This could enable a local attacker with the ability to supply a malicious firmware file to cause information disclosure or system crashes.
Technical details
The vulnerability is a buffer over-read in the aml_download_firmware() function in drivers/bluetooth/hci_aml.c. The code read segment length values from a firmware header and used them to construct memory pointers without first validating that the specified segments fit within the loaded firmware image. An attacker could craft a truncated or inconsistent firmware file with segment lengths that exceed the actual firmware size, causing the driver to read past firmware->data when constructing TCI commands. The fix adds validation to reject firmware images shorter than the header and ensures that both ICCM and DCCM segment ranges fit within the loaded firmware before processing. The patch was merged in July 2026 and backported across stable kernel series.
Affected products
- Linux Linux kernel multiple stable branches (2.6 through 7.x series)
Timeline
- 2026-09-04: disclosed: CVE-2026-80759 published
- 2026-08-07: patched: Fix merged upstream by Luiz Augusto von Dentz
- 2026-08-27: patched: Backported to stable kernel series by Greg Kroah-Hartman