Executive brief
The Linux kernel's Bluetooth subsystem contains a buffer over-read vulnerability in the LE Set CIG Parameters response handler. A malfunctioning or malicious Bluetooth controller could send a truncated response that causes the kernel to read beyond allocated memory, potentially exposing kernel data or causing a denial of service on affected systems.
Technical details
This is a buffer over-read vulnerability in the Bluetooth hci_event handler code (net/bluetooth/hci_event.c), specifically in the hci_cc_le_set_cig_params() function. The vulnerable code validates only the fixed portion of a LE Set CIG Parameters response from a Bluetooth controller and then trusts the num_handles field without validating that the remaining socket buffer (skb) contains sufficient data for all advertised handles. A malfunctioning Bluetooth controller sending a truncated response can cause the kernel to read beyond the bounds of the socket buffer. The fix adds validation to ensure the remaining skb data contains all advertised handles before processing. Exploitation requires control over a paired Bluetooth controller, limiting attack surface to adjacent physical range. The vulnerability can lead to kernel information disclosure or denial of service.
Affected products
- Linux Linux kernel Multiple versions prior to fix commit 0acd4eeb4b225b9bebbf9ef96cc10cdd79b94899
Timeline
- 2026-09-04: disclosed
- 2026-08-07: patched: Upstream patch committed