{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/hci_codec.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "fc97fc8cf7f53fd3619db63e09050d20a3a0c4b1",
              "status": "affected",
              "version": "8961987f3f5fa2f2618e72304d013c8dd5e604a6",
              "versionType": "git"
            },
            {
              "lessThan": "290b36f9d1eb9b2f72b40d826f26b4a182ab15f7",
              "status": "affected",
              "version": "8961987f3f5fa2f2618e72304d013c8dd5e604a6",
              "versionType": "git"
            },
            {
              "lessThan": "f2ad01f55e07f9531efcea736087e6b8658a3440",
              "status": "affected",
              "version": "8961987f3f5fa2f2618e72304d013c8dd5e604a6",
              "versionType": "git"
            },
            {
              "lessThan": "ec4d352747a62c1082f16c11a74b37d6eb85a5a3",
              "status": "affected",
              "version": "8961987f3f5fa2f2618e72304d013c8dd5e604a6",
              "versionType": "git"
            },
            {
              "lessThan": "4bc16db0f11918e07edf9fdcda4a30cf4c9df45c",
              "status": "affected",
              "version": "8961987f3f5fa2f2618e72304d013c8dd5e604a6",
              "versionType": "git"
            },
            {
              "lessThan": "c38fbcdc407925c7088f7e5f11c1fff73d2d35a2",
              "status": "affected",
              "version": "8961987f3f5fa2f2618e72304d013c8dd5e604a6",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/hci_codec.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.16"
            },
            {
              "lessThan": "5.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci: validate codec capability element length\n\nRead Local Codec Capabilities returns a sequence of capability elements.\nEach element starts with a one-byte length followed by that many payload\nbytes.\n\nhci_read_codec_capabilities() checks that the skb contains the length\nbyte, but then validates only caps-\u003elen against the remaining skb\nlength.  A malformed controller response with one remaining byte and\ncaps-\u003elen set to one passes that check even though the element needs two\nbytes.  The parser then records a two-byte capability and copies one\nbyte beyond the advertised response payload into the codec list.\n\nValidate the full element size, including the length byte, before adding\nit to the accumulated capability length.  This preserves all well-formed\ncapability elements and drops only truncated controller responses."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The bug is in parsing HCI Read Local Codec Capabilities command-complete data from the Bluetooth controller during HCI adapter initialization; a nearby attacker who compromises or impersonates the controller (integrated phone BT, laptop adapter, automotive head unit) can deliver malformed responses over the Bluetooth hardware link.\nAC:L - Exploitation only requires crafting controller response fields (num_caps and per-element length bytes) that pass the flawed length check; no races, timing windows, or victim-specific memory layout are needed, and the attacker fully controls the malformed HCI payload.\nPR:N - No privileges on the victim host are required; the kernel issues the HCI commands during automatic Bluetooth bring-up and trusts controller replies, so an external adjacent attacker supplying malicious controller responses needs no local account, capabilities, or user-namespace admin rights.\nUI:N - Triggering occurs during HCI device initialization when Bluetooth is powered on, which is automatic at boot or through normal always-on Bluetooth use on phones, headsets, and vehicles, without any special victim action beyond routine Bluetooth operation.\nS:U - Impact is confined to kernel memory handling within the host Bluetooth stack during codec enumeration; it does not cross a security boundary such as VM escape, container breakout, or IOMMU/DMA isolation bypass.\nC:H - The inflated capability length causes memcpy in hci_codec_list_add to read beyond the HCI response skb into adjacent kernel memory, leaking up to hundreds of bytes per response into permanently cached codec_list entries that can later be exposed via BT_CODEC socket queries.\nI:H - Out-of-bounds kernel heap access during parsing constitutes memory corruption; attacker-controlled lengths pollute kernel codec capability cache state and the same class of length-validation bugs in Bluetooth HCI parsing is routinely chained into further kernel compromise.\nA:H - Reading past the skb tail can provoke kernel faults or panics on strict memory-sanitizer builds, and corrupted codec enumeration during hci_dev_open_sync can abort Bluetooth initialization, denying Bluetooth availability until reboot or adapter reset."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:45:37.190Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/fc97fc8cf7f53fd3619db63e09050d20a3a0c4b1"
        },
        {
          "url": "https://git.kernel.org/stable/c/290b36f9d1eb9b2f72b40d826f26b4a182ab15f7"
        },
        {
          "url": "https://git.kernel.org/stable/c/f2ad01f55e07f9531efcea736087e6b8658a3440"
        },
        {
          "url": "https://git.kernel.org/stable/c/ec4d352747a62c1082f16c11a74b37d6eb85a5a3"
        },
        {
          "url": "https://git.kernel.org/stable/c/4bc16db0f11918e07edf9fdcda4a30cf4c9df45c"
        },
        {
          "url": "https://git.kernel.org/stable/c/c38fbcdc407925c7088f7e5f11c1fff73d2d35a2"
        }
      ],
      "title": "Bluetooth: hci: validate codec capability element length",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74300",
    "datePublished": "2026-08-15T05:58:03.348Z",
    "dateReserved": "2026-08-15T05:44:03.882Z",
    "dateUpdated": "2026-08-17T05:45:37.190Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}