EUVD-2026-59447
GHSA-8wcp-4xmv-gqvg
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Local vector because exploitation requires compromised or substituted local Bluetooth controller; high complexity due to hardware prerequisite; one-byte over-read yields at most partial information disclosure and possible crash.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hci: validate codec capability element length
Read Local Codec Capabilities returns a sequence of capability elements. Each element starts with a one-byte length followed by that many payload bytes.
hci_read_codec_capabilities() checks that the skb contains the length byte, but then validates only caps->len against the remaining skb length. A malformed controller response with one remaining byte and caps->len set to one passes that check even though the element needs two bytes. The parser then records a two-byte capability and copies one byte beyond the advertised response payload into the codec list.
Validate the full element size, including the length byte, before adding it to the accumulated capability length. This preserves all well-formed capability elements and drops only truncated controller responses.
AnalysisAI
Out-of-bounds memory read in the Linux kernel Bluetooth HCI subsystem enables a malformed or malicious Bluetooth controller response to the Read Local Codec Capabilities command to cause the kernel to copy one byte beyond the HCI response payload into the codec list. All kernel versions from 5.16 onward that include Bluetooth codec capability support are affected, and fixed stable releases are available across the 6.1, 6.6, 6.12, 6.18, and 7.1 branches. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the Linux kernel Bluetooth HCI subsystem is active and processes Read Local Codec Capabilities HCI responses - this code path is exercised during Bluetooth audio codec discovery, typically at Bluetooth stack initialization or when an audio device that uses HFP or A2DP codec negotiation connects. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, score 8.8) rates this as high severity under an adjacent-network Bluetooth attack model, but this appears to overstate real-world risk given that the triggering path requires a malformed response from the local Bluetooth controller rather than a direct over-the-air packet from a peer device. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has physically substituted the system's Bluetooth adapter with a malicious USB device or has compromised the Bluetooth controller firmware initiates normal Bluetooth stack activity - such as audio device connection or stack re-initialization - which triggers the Read Local Codec Capabilities HCI command. The malicious controller returns a crafted codec capability element with caps->len set to 1 and exactly one byte remaining in the response buffer, causing the kernel to read one byte beyond the legitimate payload; depending on the kernel memory layout, this could expose a byte of adjacent kernel data or trigger a BUG_ON or oops. … |
| Remediation | The primary fix is to upgrade to a patched Linux kernel stable release: 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, or 7.2-rc1. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit Linux systems running kernel versions 5.16 and later to identify those with Bluetooth codec capabilities enabled; document inventory. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today