{"id":"CVE-2026-80759","revision":"fd2c857997bd443c819a01efebe7589d","records":[{"revision":"fd2c857997bd443c819a01efebe7589d","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-80759","aliases":[],"title":"Bluetooth: hci_aml: validate firmware segment lengths","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_aml: validate firmware segment lengths\n\naml_download_firmware() reads two lengths from the firmware header and\nuses them to build pointers before checking that the header and segment\ndata are present. A truncated or inconsistent firmware image can make\nthe driver read past firmware->data while constructing TCI commands.\n\nReject images shorter than the header and ensure that the ICCM and DCCM\nranges fit within the loaded firmware before downloading either segment.","state":0,"publishedAt":"2026-09-04T15:12:28.9+00:00","modifiedAt":"2026-10-19T08:43:15.994+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/bluetooth/hci_aml.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"37bac77e4649e8158698a60addc22ec4faf5649a\",\n                            \"lessThan\": \"7733b01ed13685773ccda91035a46f87d4cfef7c\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"37bac77e4649e8158698a60addc22ec4faf5649a\",\n                            \"lessThan\": \"e1534d49a7b8ba728e84b020f6d802aa1cb759d9\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"37bac77e4649e8158698a60addc22ec4faf5649a\",\n                            \"lessThan\": \"6c70253462902d835e843b470f74aa816d60af80\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"37bac77e4649e8158698a60addc22ec4faf5649a\",\n                            \"lessThan\": \"2763b8bcb504e30ec955474f51b99ce42fc62f3b\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"37bac77e4649e8158698a60addc22ec4faf5649a\",\n                            \"lessThan\": \"2bf6b9baca9372ea51b6d0f2820dc9bf29a83ef4\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/bluetooth/hci_aml.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.12\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.12\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.106\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.47\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.1.11\",\n                            \"lessThanOrEqual\": \"7.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.1\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/7733b01ed13685773ccda91035a46f87d4cfef7c","https://git.kernel.org/stable/c/e1534d49a7b8ba728e84b020f6d802aa1cb759d9","https://git.kernel.org/stable/c/6c70253462902d835e843b470f74aa816d60af80","https://git.kernel.org/stable/c/2763b8bcb504e30ec955474f51b99ce42fc62f3b","https://git.kernel.org/stable/c/2bf6b9baca9372ea51b6d0f2820dc9bf29a83ef4"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-80759","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-80759","identifiers":["CVE-2026-80759"]},"retained":false,"historicalAffected":[]}],"coverage":[]}