CVE-2026-80763: Bluetooth: hci_event: validate LE Set CIG Parameters response
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hcievent: validate LE Set CIG Parameters response
The Command Complete dispatch validates only the fixed part of the LE Set CIG Parameters response. After that part is pulled from the skb, hcicclesetcigparams() trusts numhandles and reads each entry in the trailing handle array.
Matching numhandles against the command's numcis does not guarantee that the response contains the advertised handles. A truncated response from a malfunctioning controller can therefore make the handler read beyond the skb data.
Validate that the remaining skb data contains all advertised handles. Include this in the existing response validation so malformed responses also follow the established CIG failure handling.
Affected Software
Event History
Frequently Asked Questions
What conditions are required for this issue to occur?
The kernel must process an LE Set CIG Parameters Command Complete response whose advertised handle count exceeds the handle data actually present in the response. The description identifies a malformed or truncated response from a Bluetooth controller as the triggering condition.
Are systems affected by this during normal CIG handling?
The vulnerable path is the LE Set CIG Parameters response handler, which processes Command Complete events for CIG configuration. The provided data does not state whether CIG is enabled or used by default.
What is the practical mitigation if an updated kernel cannot be deployed immediately?
The provided data identifies malformed responses from a malfunctioning controller as the source of the issue. No configuration workaround or compensating control is specified.
How does the fix change handling of malformed controller responses?
The fix validates that the remaining response data contains every handle advertised by num_handles before reading the trailing handle array. Malformed responses are routed through the existing CIG failure handling rather than allowing reads beyond skb data.