CVE-2026-80763: Linux Kernel Bluetooth Buffer Overflow

CVE-2026-80763 Overview

CVE-2026-80763 is an out-of-bounds read vulnerability in the Linux kernel's Bluetooth subsystem. The flaw resides in the hci_cc_le_set_cig_params() handler in hci_event.c, which processes Command Complete responses for the LE Set Connected Isochronous Group (CIG) Parameters HCI command. The dispatcher validates only the fixed portion of the response before pulling it from the socket buffer (skb). The handler then trusts the num_handles field and iterates the trailing handle array without confirming that the remaining skb data holds all advertised entries. A malfunctioning or malicious Bluetooth controller returning a truncated response can cause the kernel to read past the skb payload.

Critical Impact
A malformed HCI response from a local Bluetooth controller can trigger a kernel out-of-bounds read, risking information disclosure or kernel instability.

Affected Products

Linux kernel Bluetooth (BlueZ) subsystem, net/bluetooth/hci_event.c
Kernel branches receiving the fixes referenced in the stable commits 0acd4ee, 26741d17, 6fc540e8, 9e05783d, a34df5c4, d83ecb7b, and e3f82e8f
Distributions redistributing affected upstream kernels prior to those backports

Discovery Timeline

2026-09-04 - CVE-2026-80763 published to NVD
2026-09-04 - Last updated in NVD database

Technical Details for CVE-2026-80763

Vulnerability Analysis

The defect is an out-of-bounds read in the Bluetooth Host Controller Interface (HCI) event path. When the controller returns a Command Complete for LE Set CIG Parameters, the dispatch layer pulls the fixed response header from the skb and hands the remainder to hci_cc_le_set_cig_params(). The handler reads num_handles from the response and walks a variable-length array of Connection Isochronous Stream (CIS) connection handles that follow the header.

The existing validation only compares num_handles against the num_cis value from the original command. That check does not confirm that the skb actually carries num_handles entries. If the controller returns a shorter buffer than advertised, the loop reads past the tail of the skb into adjacent memory. The upstream fix extends response validation to require that the remaining skb data is large enough to hold every advertised handle, and routes malformed responses through the established CIG failure handling.

Root Cause

The root cause is missing bounds validation between a length field supplied by an untrusted peripheral and the actual size of the containing skb. The handler trusts num_handles as authoritative for iteration without cross-checking skb->len. This is a classic length-versus-buffer mismatch in a parser that consumes attacker-influenced input.

Attack Vector

Exploitation requires a Bluetooth controller that returns a truncated Command Complete for the LE Set CIG Parameters opcode. This can occur with a buggy or hostile controller, a compromised firmware image, or a virtualized or emulated HCI transport that an attacker controls. The vulnerability is reached through the local HCI transport rather than over the air, but any adversary able to influence responses from the controller to the host kernel can trigger the out-of-bounds read.

See the upstream fix commits referenced in the Linux Kernel Commit - e3f82e8f and related stable backports for the exact patch mechanics.

Detection Methods for CVE-2026-80763

Indicators of Compromise

Kernel log entries from the Bluetooth subsystem reporting CIG parameter failures or malformed LE Set CIG Parameters responses.
Unexpected KASAN or slab-out-of-bounds reports referencing hci_cc_le_set_cig_params or nearby hci_event.c symbols.
Repeated Bluetooth controller resets or hci0 link-layer errors correlated with LE Audio or isochronous stream setup.

Detection Strategies

Enable KASAN on test kernels to surface the out-of-bounds read during Bluetooth fuzzing or QA of LE Audio workflows.
Ingest dmesg and journald Bluetooth events into a centralized logging pipeline and alert on repeated CIG-related failures from a single host.
Track loaded kernel versions across the fleet and flag hosts running Bluetooth-enabled kernels that predate the referenced stable fix commits.

Monitoring Recommendations

Monitor endpoint telemetry for unexpected kernel crashes or Bluetooth stack restarts on systems that use LE Audio or CIS.
Correlate Bluetooth HCI errors with peripheral pairing events to identify controllers producing malformed responses.
Track patch state of linux-image and vendor kernel packages through configuration management to confirm remediation coverage.

How to Mitigate CVE-2026-80763

Immediate Actions Required

Apply the upstream Linux stable kernel updates that include the response-length validation fix.
On systems that do not require Bluetooth, disable the bluetooth and btusb kernel modules and block them from loading.
Restrict physical and USB access to prevent attachment of untrusted Bluetooth controllers or HCI dongles.

Patch Information

Upstream fixes are distributed across the following stable commits: 0acd4ee, 26741d17, 6fc540e8, 9e05783d, a34df5c4, d83ecb7b, and e3f82e8f. Consume the fix through your distribution's kernel package once the corresponding backport lands.

Workarounds

Blacklist the Bluetooth kernel modules on servers and hardened endpoints that do not require Bluetooth connectivity.
Disable LE Audio and Connected Isochronous Stream features in userspace stacks such as BlueZ where the workflow permits.
Enforce USB device control policies that block unauthorized Bluetooth HCI transports from attaching to production hosts.

bash

# Configuration example: block Bluetooth kernel modules on hosts that do not need them
echo 'install bluetooth /bin/true' | sudo tee /etc/modprobe.d/disable-bluetooth.conf
echo 'install btusb /bin/true'    | sudo tee -a /etc/modprobe.d/disable-bluetooth.conf
sudo systemctl disable --now bluetooth.service
sudo rmmod btusb bluetooth 2>/dev/null || true