CVE-2026-80759: Bluetooth: hci_aml: validate firmware segment lengths
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hciaml: validate firmware segment lengths
amldownloadfirmware() reads two lengths from the firmware header and uses them to build pointers before checking that the header and segment data are present. A truncated or inconsistent firmware image can make the driver read past firmware->data while constructing TCI commands.
Reject images shorter than the header and ensure that the ICCM and DCCM ranges fit within the loaded firmware before downloading either segment.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems running the Linux kernel with the hci_aml Bluetooth driver are exposed when that driver processes an AML firmware image. The issue is triggered by a firmware image that is truncated or has inconsistent segment-length fields.
What must an attacker or faulty deployment provide to trigger the vulnerability?
The driver must be given a malformed firmware image whose header lengths cause ICCM or DCCM segment ranges to extend beyond the loaded firmware data. The vulnerable code can read beyond firmware->data while constructing TCI commands.
What is the relevant mitigation if an updated kernel cannot be deployed immediately?
Ensure that only complete, consistent AML firmware images are supplied to the driver. In particular, avoid firmware images shorter than the expected header or with ICCM or DCCM lengths that exceed the available firmware data.
How can I determine whether a firmware image is malformed in the way described?
Check that the image is at least large enough to contain its header, then verify that both ICCM and DCCM ranges described by the header fit entirely within the loaded firmware file. Images failing either check should be rejected.