Executive brief
The Linux kernel's Bluetooth management interface contains a validation flaw in the HCI_CMD_SYNC command handler that allows parameters larger than 255 bytes to be accepted, even though the HCI command header can only store parameter length in a single byte. This causes a mismatch where the frame declares no parameters but carries them, potentially corrupting the data stream to the Bluetooth controller and enabling unauthorized command injection or controller malfunction.
Technical details
The vulnerability exists in the mgmt_hci_cmd_sync() function in net/bluetooth/mgmt.c, which validates that the message length agrees with the params_len field (a __le16 value). However, it fails to enforce that params_len fits within a u8, which is the size of the plen field in the HCI command header structure. When a params_len value between 256 and approximately 1KB is supplied, hci_cmd_sync_alloc() assigns this oversized value to the u8 plen field, causing truncation; the header declares zero parameters while all parameters are still appended. On length-framed transports (H:4), the Bluetooth controller interprets trailing bytes as the start of the next packet, enabling packet boundary confusion and potential command injection. The fix adds an explicit check to reject params_len values exceeding U8_MAX (255) before processing.
Affected products
- Linux Linux kernel prior to the fix commit (affects multiple stable branches)
Timeline
- 2026-09-04: disclosed: CVE published
- 2026-08-07: patched: Upstream fix committed
- 2026-08-27: patched: Fix merged to stable branches