CVE-2026-74300
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
In the Linux kernel, the Bluetooth hci subsystem has a vulnerability due to improper validation of the capability element length in controller responses. hci_read_codec_capabilities() only checks the payload length but does not account for the length byte, allowing out-of-bounds read. The fix validates the full element size including the length byte.
Risk Assessment
A malicious Bluetooth controller could send a malformed response, leading to out-of-bounds read of kernel memory, potentially exposing sensitive data or causing a crash.
Recommendation
Update the Linux kernel to a version with the fix for CVE-2026-74300. Limit trust in Bluetooth controllers.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci: validate codec capability element length Read Local Codec Capabilities returns a sequence of capability elements. Each element starts with a one-byte length followed by that many payload bytes. hci_read_codec_capabilities() checks that the skb contains the length byte, but then validates only caps->len against the remaining skb length. A malformed controller response with one remaining byte and caps->len set to one passes that check even though the element needs two bytes. The parser then records a two-byte capability and copies one byte beyond the advertised response payload into the codec list. Validate the full element size, including the length byte, before adding it to the accumulated capability length. This preserves all well-formed capability elements and drops only truncated controller responses.