Bug 2516887 (CVE-2026-74300)

Summary: CVE-2026-74300 kernel: Bluetooth: hci: validate codec capability element length
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: rhel-process-autobot, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the Linux kernel's Bluetooth Host Controller Interface (HCI) component. A malicious Bluetooth controller could send a specially crafted response during the 'Read Local Codec Capabilities' operation. Insufficient validation of the codec capability element length could allow the system to write one byte beyond the intended memory buffer. This out-of-bounds write could lead to memory corruption within the kernel.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-15 06:38:40 UTC 
In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci: validate codec capability element length

Read Local Codec Capabilities returns a sequence of capability elements.
Each element starts with a one-byte length followed by that many payload
bytes.

hci_read_codec_capabilities() checks that the skb contains the length
byte, but then validates only caps->len against the remaining skb
length.  A malformed controller response with one remaining byte and
caps->len set to one passes that check even though the element needs two
bytes.  The parser then records a two-byte capability and copies one
byte beyond the advertised response payload into the codec list.

Validate the full element size, including the length byte, before adding
it to the accumulated capability length.  This preserves all well-formed
capability elements and drops only truncated controller responses.
Comment 1 Keith Grant 2026-08-20 15:36:32 UTC 
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026081549-CVE-2026-74300-c70a@gregkh/T