CVE-2026-80759: Linux Kernel Bluetooth Buffer Overflow

CVE-2026-80759 Overview

CVE-2026-80759 is an out-of-bounds read vulnerability in the Linux kernel Bluetooth hci_aml driver. The flaw resides in aml_download_firmware(), which reads two length fields from a firmware header and constructs pointers before verifying that the header and segment data actually fit within the loaded firmware image. A truncated or malformed firmware image can cause the driver to read past firmware->data while building Transport Control Interface (TCI) commands. The upstream fix rejects images shorter than the header and validates that the Instruction Closely Coupled Memory (ICCM) and Data Closely Coupled Memory (DCCM) ranges fit within the loaded firmware before either segment is downloaded.

Critical Impact
A malformed or truncated firmware image for Amlogic Bluetooth hardware can trigger kernel out-of-bounds reads, risking information disclosure or kernel instability.

Affected Products

Linux kernel versions containing the hci_aml Bluetooth driver prior to the fix
Systems using Amlogic Bluetooth hardware that load firmware through aml_download_firmware()
Distributions shipping stable kernels that have not yet backported the referenced patches

Discovery Timeline

2026-09-04 - CVE-2026-80759 published to NVD
2026-09-04 - Last updated in NVD database

Technical Details for CVE-2026-80759

Vulnerability Analysis

The hci_aml driver loads firmware for Amlogic Bluetooth controllers and parses a header that describes two segments: ICCM and DCCM. The aml_download_firmware() function reads the segment lengths from this header and uses them to compute pointers into the firmware buffer. The driver then issues TCI commands referencing those pointers.

The function performs pointer arithmetic before confirming that the firmware buffer is large enough to contain the header itself, and before confirming that the declared ICCM and DCCM ranges fall within the buffer. When the firmware image is shorter than expected or its declared segment sizes exceed the actual buffer, the driver reads memory past the end of firmware->data.

The out-of-bounds read occurs in kernel space during firmware download, which typically runs early in device probe. Consequences include leaking adjacent kernel memory into TCI command payloads and potential kernel crashes when the read crosses an unmapped page boundary.

Root Cause

The root cause is missing input validation on attacker-influenced length fields parsed from an external firmware blob. The driver trusted the declared segment lengths without cross-checking them against firmware->size. This is an out-of-bounds read pattern caused by improper validation of a length parameter used in pointer arithmetic.

Attack Vector

Exploitation requires the driver to load a malicious or corrupted firmware image. In practice this means an actor with the ability to place or modify a firmware file on the filesystem, or supply a tampered firmware package during system provisioning. The vulnerability is not remotely reachable over Bluetooth radio; it is triggered by the firmware loading path itself during hci_aml initialization.

Because no verified public exploit is available and no code examples were released with the advisory, the vulnerability is described in prose only. Refer to the upstream commits for the exact validation logic added to aml_download_firmware().

// No verified exploit code available.
// See upstream kernel patches for the added length validation:
// - Patch 2763b8b, 2bf6b9ba, 6c702534, 7733b01e, e1534d49

Detection Methods for CVE-2026-80759

Indicators of Compromise

Unexpected hci_aml driver warnings, KASAN out-of-bounds read reports, or oopses referencing aml_download_firmware in dmesg
Firmware files under /lib/firmware/ for Amlogic Bluetooth devices with sizes inconsistent with vendor-supplied images
Repeated Bluetooth controller initialization failures on Amlogic-based hardware after firmware changes

Detection Strategies

Enable Kernel Address Sanitizer (KASAN) on test kernels to surface out-of-bounds reads inside aml_download_firmware()
Compare installed kernel versions against the stable trees containing the referenced fix commits
Audit filesystem integrity for /lib/firmware/ contents on Amlogic Bluetooth deployments

Monitoring Recommendations

Forward kernel logs to a centralized logging pipeline and alert on hci_aml errors or Bluetooth subsystem crashes
Track kernel package versions across the fleet and flag hosts running unpatched builds
Monitor for unauthorized writes to firmware directories using file integrity monitoring

How to Mitigate CVE-2026-80759

Immediate Actions Required

Apply the upstream stable kernel updates that include the hci_aml firmware length validation fix
Restrict write access to /lib/firmware/ to root and privileged provisioning tooling only
On Amlogic Bluetooth systems where patching is delayed, disable or unload the hci_aml driver until the fix is applied

Patch Information

The fix has been merged across multiple stable branches. Refer to the upstream commits: Kernel Git Patch 2763b8b, Kernel Git Patch 2bf6b9ba, Kernel Git Patch 6c702534, Kernel Git Patch 7733b01e, and Kernel Git Patch e1534d49. The patch rejects images shorter than the header and validates ICCM and DCCM ranges against the loaded firmware size before downloading either segment.

Workarounds

Blacklist the hci_aml kernel module on systems that do not require Amlogic Bluetooth functionality
Enforce strict filesystem permissions and integrity monitoring on /lib/firmware/ to prevent unauthorized firmware replacement
Ship only vendor-signed, size-verified firmware images through your provisioning pipeline

bash

# Prevent the vulnerable driver from loading until patched
echo "blacklist hci_aml" | sudo tee /etc/modprobe.d/blacklist-hci-aml.conf
sudo modprobe -r hci_aml 2>/dev/null || true
sudo update-initramfs -u