CVE-2026-80763: Bluetooth: hci_event: validate LE Set CIG Parameters response
Bluetooth: hcievent: validate LE Set CIG Parameters response
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.157.1-1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Validate that the remaining skb data contains all advertised handles before hci_cc_le_set_cig_params() reads the trailing handle array, and route malformed responses through the established CIG failure handling.
Event History
Frequently Asked Questions
What conditions are required for this issue to occur?
The kernel must process an LE Set CIG Parameters Command Complete response whose advertised handle count exceeds the handle data actually present in the response. The description identifies a malformed or truncated response from a Bluetooth controller as the triggering condition.
Are systems affected by this during normal CIG handling?
The vulnerable path is the LE Set CIG Parameters response handler, which processes Command Complete events for CIG configuration. The provided data does not state whether CIG is enabled or used by default.
What is the practical mitigation if an updated kernel cannot be deployed immediately?
The provided data identifies malformed responses from a malfunctioning controller as the source of the issue. No configuration workaround or compensating control is specified.
How does the fix change handling of malformed controller responses?
The fix validates that the remaining response data contains every handle advertised by num_handles before reading the trailing handle array. Malformed responses are routed through the existing CIG failure handling rather than allowing reads beyond skb data.