CVE-2026-80760 Overview
CVE-2026-80760 affects the Linux kernel Bluetooth Management (MGMT) subsystem. The flaw resides in mgmt_hci_cmd_sync(), which validates that the message length matches params_len but never enforces an upper bound. Because params_len is a 16-bit little-endian value while the Host Controller Interface (HCI) command header parameter length (plen) is a u8, oversized values silently truncate. A params_len of 256 leaves plen at 0 while all 256 bytes are still appended to the socket buffer, corrupting the HCI framing.
Critical Impact
Malformed MGMT commands with params_len above 255 desynchronize the HCI transport, allowing trailing bytes to be interpreted by the controller as the start of the next packet on length-framed transports such as H:4.
Affected Products
- Linux kernel Bluetooth subsystem (net/bluetooth) — MGMT interface
- Distributions shipping kernels prior to the fix commits 0bd0195c, 5d95286b, 6e1c4487, and b7d9edcf
- Systems exposing the MGMT socket to local users with CAP_NET_ADMIN
Discovery Timeline
- 2026-09-04 - CVE-2026-80760 published to NVD
- 2026-09-04 - Last updated in NVD database
Technical Details for CVE-2026-80760
Vulnerability Analysis
The defect lies in the interaction between the MGMT command parser and hci_cmd_sync_alloc(). The MGMT socket accepts commands sized up to HCI_MAX_FRAME_SIZE, so params_len can reach roughly 1KB. hci_cmd_sync_alloc() assigns the 16-bit plen argument directly into the header field hdr->plen = plen, which is a u8. It then calls skb_put_data(skb, param, plen) using the untruncated length. The controller receives a frame whose header advertises a smaller (or zero) parameter count while the socket buffer carries the full oversized payload.
The prior fix in commit 03f1700b9b4d ("Bluetooth: MGMT: reject malformed HCI_CMD_SYNC commands") only enforced agreement between params_len and the message length. It did not bound params_len to the header field width, so a value that fits the MGMT message but overflows the HCI header is still accepted.
Root Cause
The root cause is an integer truncation combined with missing input validation. Assigning a __le16 value into a __u8 header field silently drops the high byte. There is no explicit check that params_len <= U8_MAX before the assignment.
Attack Vector
A local process with the ability to open an MGMT socket can craft an HCI_CMD_SYNC command with params_len between 256 and approximately 1024. The kernel forwards the malformed frame to the driver, and on length-framed transports such as H:4 the controller misinterprets the trailing bytes as the beginning of the next HCI packet. This produces HCI state desynchronization, controller misbehavior, and potential injection of attacker-influenced bytes into subsequent protocol handling.
No verified public exploit code is available. Refer to the upstream fix commits linked in the Kernel Git Commit - 0bd0195c reference for the exact patch semantics.
Detection Methods for CVE-2026-80760
Indicators of Compromise
- Unexpected HCI transport resynchronization events or controller resets in dmesg and Bluetooth subsystem logs
- MGMT socket activity from unprivileged or unexpected processes attempting HCI_CMD_SYNC operations
- Bluetooth controller entering an error state shortly after a userland process writes to an MGMT socket
Detection Strategies
- Audit local processes invoking bind() on AF_BLUETOOTH sockets with the MGMT protocol and correlate with process lineage
- Instrument the mgmt_hci_cmd_sync code path via kprobes or eBPF to flag calls where params_len > 255
- Review kernel version inventory against the fix commits 0bd0195c, 5d95286b, 6e1c4487, and b7d9edcf
Monitoring Recommendations
- Forward kernel and Bluetooth daemon logs to a central telemetry pipeline for anomaly review
- Alert on repeated HCI command failures or transport reinitializations on endpoints with Bluetooth enabled
- Track CAP_NET_ADMIN grants and MGMT socket usage on servers and workstations that do not require Bluetooth
How to Mitigate CVE-2026-80760
Immediate Actions Required
- Apply the upstream kernel patches referenced by commits 0bd0195c, 5d95286b, 6e1c4487, and b7d9edcf
- Track distribution advisories and deploy the vendor kernel update once available
- On systems that do not require Bluetooth, blacklist the bluetooth and btusb kernel modules
Patch Information
The fix rejects any params_len that does not fit the 8-bit HCI header plen field. Upstream commits are available at Kernel Git Commit - 0bd0195c, Kernel Git Commit - 5d95286b, Kernel Git Commit - 6e1c4487, and Kernel Git Commit - b7d9edcf.
Workarounds
- Restrict CAP_NET_ADMIN to trusted service accounts to prevent unprivileged users from opening MGMT sockets
- Disable Bluetooth on hosts that do not require it via systemctl disable --now bluetooth and module blacklisting
- Apply seccomp or AppArmor profiles that deny AF_BLUETOOTH socket creation to untrusted workloads
# Configuration example: disable Bluetooth stack where not required
systemctl disable --now bluetooth.service
echo 'blacklist bluetooth' | sudo tee /etc/modprobe.d/blacklist-bluetooth.conf
echo 'blacklist btusb' | sudo tee -a /etc/modprobe.d/blacklist-bluetooth.conf
sudo update-initramfs -u
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
